Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit 09c6eb1f651dad601f02435bbd79734954960c42

Authored by Manfred Spraul
Committed by Linus Torvalds
1 parent 247a8ce822
Exists in ti-lsk-linux-4.1.y and in 10 other branches dlt-processor-sdk-linux-03.00.00.04, processor-sdk-linux-02.00.01, smarc-ti-lsk-linux-4.1.y, smarct3x-processor-sdk-04.01.00.06, smarct3x-processor-sdk-linux-02.00.01, smarct3x-processor-sdk-linux-03.00.00.04, smarct4x-800-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-04.01.00.06, smarct4x-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-linux-03.00.00.04

ipc/shm.c: check for overflows of shm_tot 

shm_tot counts the total number of pages used by shm segments.

If SHMALL is ULONG_MAX (or nearly ULONG_MAX), then the number can
overflow.  Subsequent calls to shmctl(,SHM_INFO,) would return wrong
values for shm_tot.

The patch adds a detection for overflows.

Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Acked-by: Davidlohr Bueso <davidlohr@hp.com>
Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Acked-by: Michael Kerrisk <mtk.manpages@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 2 additions and 1 deletions Side-by-side Diff

... ... @@ -493,7 +493,8 @@
493 493 if (size < SHMMIN || size > ns->shm_ctlmax)
494 494 return -EINVAL;
495 495  
496   - if (ns->shm_tot + numpages > ns->shm_ctlall)
  496 + if (ns->shm_tot + numpages < ns->shm_tot ||
  497 + ns->shm_tot + numpages > ns->shm_ctlall)
497 498 return -ENOSPC;
498 499  
499 500 shp = ipc_rcu_alloc(sizeof(*shp));