lkml.org 
[lkml]   [2001]   [Sep]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] 2.2.19 - semadj overflow in ipc/sem.c
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Allan's patch for 2.4.9-ac14 plus some minor modifications.

- --

Leonid Igolnik.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE7rPmqRrKFtN3cJpMRAsaMAJ94PZIZv9BLnLlOXQaq16Egrdb28ACfZyTL
7pK0jf1rJ/FBUCyeYfwuZF4=
=/pbV
-----END PGP SIGNATURE-----
diff -ubr linux-2.2.19/ipc/sem.c linux-2.2.19.lim/ipc/sem.c
--- linux-2.2.19/ipc/sem.c Sun Mar 25 11:31:15 2001
+++ linux-2.2.19.lim/ipc/sem.c Sat Sep 22 16:38:40 2001
@@ -229,7 +229,19 @@
curr->sempid = (curr->sempid << 16) | pid;
curr->semval += sem_op;
if (sop->sem_flg & SEM_UNDO)
- un->semadj[sop->sem_num] -= sem_op;
+ {
+ int undo = un->semadj[sop->sem_num] - sem_op;
+ /*
+ * Exceeding the undo range is an error.
+ */
+ if(undo < (-SEMAEM - 1) || undo > SEMAEM)
+ {
+ /* Don't undo the undo */
+ sop->sem_flg &= ~SEM_UNDO;
+ goto out_of_range;
+ }
+ un->semadj[sop->sem_num] = undo;
+ }

if (curr->semval < 0)
goto would_block;
diff -ubr linux-2.2.19/include/linux/sem.h linux-2.2.19.lim/include/linux/sem.h
--- linux-2.2.19/include/linux/sem.h Sun Mar 25 11:31:03 2001
+++ linux-2.2.19.lim/include/linux/sem.h Sat Sep 22 16:39:22 2001
@@ -65,11 +65,11 @@
#define SEMMNS (SEMMNI*SEMMSL) /* ? max # of semaphores in system */
#define SEMOPM 32 /* ~ 100 max num of ops per semop call */
#define SEMVMX 32767 /* semaphore maximum value */
+#define SEMAEM SEMVMX /* adjust on exit max value */

/* unused */
#define SEMUME SEMOPM /* max num of undo entries per process */
#define SEMMNU SEMMNS /* num of undo structures system wide */
-#define SEMAEM (SEMVMX >> 1) /* adjust on exit max value */
#define SEMMAP SEMMNS /* # of entries in semaphore map */
#define SEMUSZ 20 /* sizeof struct sem_undo */
\
 
 \ /
  Last update: 2005-03-22 13:03    [W:0.040 / U:15.812 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site