lkml.org 
[lkml]   [2014]   [Apr]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 1/4] ipc/shm.c: check for ulong overflows in shmat
    Date
    find_vma_intersection does not work as intended if addr+size overflows.
    The patch adds a manual check before the call to find_vma_intersection.

    Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
    ---
    ipc/shm.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/ipc/shm.c b/ipc/shm.c
    index 7645961..382e2fb 100644
    --- a/ipc/shm.c
    +++ b/ipc/shm.c
    @@ -1160,6 +1160,9 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
    down_write(&current->mm->mmap_sem);
    if (addr && !(shmflg & SHM_REMAP)) {
    err = -EINVAL;
    + if (addr + size < addr)
    + goto invalid;
    +
    if (find_vma_intersection(current->mm, addr, addr + size))
    goto invalid;
    /*
    --
    1.9.0


    \
     
     \ /
      Last update: 2014-04-21 17:01    [W:4.146 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site