Messages in this thread Patch in this message |  | | Date | Sat, 22 Sep 2001 16:50:48 -0400 (EDT) | From | Leonid Igolnik <> | Subject | [PATCH] 2.2.19 - semadj overflow in ipc/sem.c |
| |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Allan's patch for 2.4.9-ac14 plus some minor modifications.
- --
Leonid Igolnik.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org
iD8DBQE7rPmqRrKFtN3cJpMRAsaMAJ94PZIZv9BLnLlOXQaq16Egrdb28ACfZyTL 7pK0jf1rJ/FBUCyeYfwuZF4= =/pbV -----END PGP SIGNATURE----- diff -ubr linux-2.2.19/ipc/sem.c linux-2.2.19.lim/ipc/sem.c --- linux-2.2.19/ipc/sem.c Sun Mar 25 11:31:15 2001 +++ linux-2.2.19.lim/ipc/sem.c Sat Sep 22 16:38:40 2001 @@ -229,7 +229,19 @@ curr->sempid = (curr->sempid << 16) | pid; curr->semval += sem_op; if (sop->sem_flg & SEM_UNDO) - un->semadj[sop->sem_num] -= sem_op; + { + int undo = un->semadj[sop->sem_num] - sem_op; + /* + * Exceeding the undo range is an error. + */ + if(undo < (-SEMAEM - 1) || undo > SEMAEM) + { + /* Don't undo the undo */ + sop->sem_flg &= ~SEM_UNDO; + goto out_of_range; + } + un->semadj[sop->sem_num] = undo; + } if (curr->semval < 0) goto would_block; diff -ubr linux-2.2.19/include/linux/sem.h linux-2.2.19.lim/include/linux/sem.h --- linux-2.2.19/include/linux/sem.h Sun Mar 25 11:31:03 2001 +++ linux-2.2.19.lim/include/linux/sem.h Sat Sep 22 16:39:22 2001 @@ -65,11 +65,11 @@ #define SEMMNS (SEMMNI*SEMMSL) /* ? max # of semaphores in system */ #define SEMOPM 32 /* ~ 100 max num of ops per semop call */ #define SEMVMX 32767 /* semaphore maximum value */ +#define SEMAEM SEMVMX /* adjust on exit max value */ /* unused */ #define SEMUME SEMOPM /* max num of undo entries per process */ #define SEMMNU SEMMNS /* num of undo structures system wide */ -#define SEMAEM (SEMVMX >> 1) /* adjust on exit max value */ #define SEMMAP SEMMNS /* # of entries in semaphore map */ #define SEMUSZ 20 /* sizeof struct sem_undo */ |  |