lkml.org 
[lkml]   [2014]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 1/4] ipc/shm.c: check for ulong overflows in shmat
    On 04/21/2014 04:26 PM, Manfred Spraul wrote:
    > find_vma_intersection does not work as intended if addr+size overflows.
    > The patch adds a manual check before the call to find_vma_intersection.
    >
    > Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
    > ---
    > ipc/shm.c | 3 +++
    > 1 file changed, 3 insertions(+)
    >
    > diff --git a/ipc/shm.c b/ipc/shm.c
    > index 7645961..382e2fb 100644
    > --- a/ipc/shm.c
    > +++ b/ipc/shm.c
    > @@ -1160,6 +1160,9 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
    > down_write(&current->mm->mmap_sem);
    > if (addr && !(shmflg & SHM_REMAP)) {
    > err = -EINVAL;
    > + if (addr + size < addr)
    > + goto invalid;
    > +
    > if (find_vma_intersection(current->mm, addr, addr + size))
    > goto invalid;
    > /*
    >

    Acked-by: Michael Kerrisk <mtk.manpages@gmail.com>

    --
    Michael Kerrisk
    Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
    Linux/UNIX System Programming Training: http://man7.org/training/


    \
     
     \ /
      Last update: 2014-04-23 07:41    [W:2.897 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site