2 files changed, 3 insertions, 3 deletions
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index abd3e0ea762a..99f0ad753f32 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -42,7 +42,7 @@
 * Returns 0 if the range is valid, nonzero otherwise.
 *
 * This is equivalent to the following test:
- * (u33)addr + (u33)size >= (u33)current->addr_limit.seg (u65 for x86_64)
+ * (u33)addr + (u33)size > (u33)current->addr_limit.seg (u65 for x86_64)
 *
 * This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry...
 */
diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
index d17a1170bbf5..024840266ba0 100644
--- a/arch/x86/lib/copy_user_64.S
+++ b/arch/x86/lib/copy_user_64.S
@@ -79,7 +79,7 @@ ENTRY(_copy_to_user)
        addq %rdx,%rcx
        jc bad_to_user
        cmpq TI_addr_limit(%rax),%rcx
-        jae bad_to_user
+        ja bad_to_user
        ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
                copy_user_generic_unrolled,copy_user_generic_string,    \
                copy_user_enhanced_fast_string
@@ -94,7 +94,7 @@ ENTRY(_copy_from_user)
        addq %rdx,%rcx
        jc bad_from_user
        cmpq TI_addr_limit(%rax),%rcx
-        jae bad_from_user
+        ja bad_from_user
        ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
                copy_user_generic_unrolled,copy_user_generic_string,    \
                copy_user_enhanced_fast_string

diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h index abd3e0ea762a..99f0ad753f32 100644 --- a/arch/x86/include/asm/uaccess.h +++ b/arch/x86/include/asm/uaccess.h
@@ -42,7 +42,7 @@
42	* Returns 0 if the range is valid, nonzero otherwise.	42	* Returns 0 if the range is valid, nonzero otherwise.
43	*	43	*
44	* This is equivalent to the following test:	44	* This is equivalent to the following test:
45	* (u33)addr + (u33)size >= (u33)current->addr_limit.seg (u65 for x86_64)	45	* (u33)addr + (u33)size > (u33)current->addr_limit.seg (u65 for x86_64)
46	*	46	*
47	* This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry...	47	* This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry...
48	*/	48	*/


diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S index d17a1170bbf5..024840266ba0 100644 --- a/arch/x86/lib/copy_user_64.S +++ b/arch/x86/lib/copy_user_64.S
@@ -79,7 +79,7 @@ ENTRY(_copy_to_user)
79	addq %rdx,%rcx	79	addq %rdx,%rcx
80	jc bad_to_user	80	jc bad_to_user
81	cmpq TI_addr_limit(%rax),%rcx	81	cmpq TI_addr_limit(%rax),%rcx
82	jae bad_to_user	82	ja bad_to_user
83	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \	83	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
84	copy_user_generic_unrolled,copy_user_generic_string, \	84	copy_user_generic_unrolled,copy_user_generic_string, \
85	copy_user_enhanced_fast_string	85	copy_user_enhanced_fast_string
@@ -94,7 +94,7 @@ ENTRY(_copy_from_user)
94	addq %rdx,%rcx	94	addq %rdx,%rcx
95	jc bad_from_user	95	jc bad_from_user
96	cmpq TI_addr_limit(%rax),%rcx	96	cmpq TI_addr_limit(%rax),%rcx
97	jae bad_from_user	97	ja bad_from_user
98	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \	98	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
99	copy_user_generic_unrolled,copy_user_generic_string, \	99	copy_user_generic_unrolled,copy_user_generic_string, \
100	copy_user_enhanced_fast_string	100	copy_user_enhanced_fast_string