lkml.org 
[lkml]   [2014]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 2/4] ipc/shm.c: check for overflows of shm_tot
On 04/21/2014 04:26 PM, Manfred Spraul wrote:
> shm_tot counts the total number of pages used by shm segments.
>
> If SHMALL is ULONG_MAX (or nearly ULONG_MAX), then the number
> can overflow. Subsequent calls to shmctl(,SHM_INFO,) would return
> wrong values for shm_tot.
>
> The patch adds a detection for overflows.
>
> Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
> ---
> ipc/shm.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/ipc/shm.c b/ipc/shm.c
> index 382e2fb..2dfa3d6 100644
> --- a/ipc/shm.c
> +++ b/ipc/shm.c
> @@ -493,7 +493,8 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
> if (size < SHMMIN || size > ns->shm_ctlmax)
> return -EINVAL;
>
> - if (ns->shm_tot + numpages > ns->shm_ctlall)
> + if (ns->shm_tot + numpages < ns->shm_tot ||
> + ns->shm_tot + numpages > ns->shm_ctlall)
> return -ENOSPC;
>
> shp = ipc_rcu_alloc(sizeof(*shp));
>

Acked-by: Michael Kerrisk <mtk.manpages@gmail.com>

--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/


\
 
 \ /
  Last update: 2014-04-23 07:41    [W:0.275 / U:0.228 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site