| From | Manfred Spraul <> | Subject | [PATCH 2/4] ipc/shm.c: check for overflows of shm_tot | Date | Mon, 21 Apr 2014 16:26:35 +0200 |
| |
shm_tot counts the total number of pages used by shm segments.
If SHMALL is ULONG_MAX (or nearly ULONG_MAX), then the number can overflow. Subsequent calls to shmctl(,SHM_INFO,) would return wrong values for shm_tot.
The patch adds a detection for overflows.
Signed-off-by: Manfred Spraul <manfred@colorfullife.com> --- ipc/shm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/ipc/shm.c b/ipc/shm.c index 382e2fb..2dfa3d6 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -493,7 +493,8 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) if (size < SHMMIN || size > ns->shm_ctlmax) return -EINVAL; - if (ns->shm_tot + numpages > ns->shm_ctlall) + if (ns->shm_tot + numpages < ns->shm_tot || + ns->shm_tot + numpages > ns->shm_ctlall) return -ENOSPC; shp = ipc_rcu_alloc(sizeof(*shp)); -- 1.9.0
|