lkml.org 
[lkml]   [2012]   [Feb]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH 11/91] ARM: 6891/1: prevent heap corruption in OABI semtimedop
2.6.27-longterm review patch.  If anyone has any objections, please let us know.

------------------

commit 0f22072ab50cac7983f9660d33974b45184da4f9 upstream.

When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
bound the nsops argument. A sufficiently large value will cause an
integer overflow in allocation size, followed by copying too much data
into the allocated buffer. Fix this by restricting nsops to SEMOPM.
Untested.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/arm/kernel/sys_oabi-compat.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

Index: longterm-2.6.27/arch/arm/kernel/sys_oabi-compat.c
===================================================================
--- longterm-2.6.27.orig/arch/arm/kernel/sys_oabi-compat.c 2012-02-05 22:34:34.686915228 +0100
+++ longterm-2.6.27/arch/arm/kernel/sys_oabi-compat.c 2012-02-05 22:34:36.482915240 +0100
@@ -319,7 +319,7 @@
long err;
int i;

- if (nsops < 1)
+ if (nsops < 1 || nsops > SEMOPM)
return -EINVAL;
sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
if (!sops)



\
 
 \ /
  Last update: 2012-02-05 23:29    [W:0.288 / U:1.092 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site