Messages in this thread Patch in this message | | | From | Manfred Spraul <> | Subject | [PATCH 1/4] ipc/shm.c: check for ulong overflows in shmat | Date | Sat, 19 Apr 2014 13:43:38 +0200 |
| |
find_vma_intersection does not work properly if addr+size overflows. The patch adds a manual check before the call to find_vma_intersection.
Signed-off-by: Manfred Spraul <manfred@colorfullife.com> --- ipc/shm.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/ipc/shm.c b/ipc/shm.c index 7645961..382e2fb 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -1160,6 +1160,9 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr, down_write(¤t->mm->mmap_sem); if (addr && !(shmflg & SHM_REMAP)) { err = -EINVAL; + if (addr + size < addr) + goto invalid; + if (find_vma_intersection(current->mm, addr, addr + size)) goto invalid; /* -- 1.9.0
| |