Messages in this thread | | | Date | Wed, 23 Apr 2014 06:58:15 +0200 | From | "Michael Kerrisk (man-pages)" <> | Subject | Re: [PATCH 1/4] ipc/shm.c: check for ulong overflows in shmat |
| |
On 04/21/2014 04:26 PM, Manfred Spraul wrote: > find_vma_intersection does not work as intended if addr+size overflows. > The patch adds a manual check before the call to find_vma_intersection. > > Signed-off-by: Manfred Spraul <manfred@colorfullife.com> > --- > ipc/shm.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/ipc/shm.c b/ipc/shm.c > index 7645961..382e2fb 100644 > --- a/ipc/shm.c > +++ b/ipc/shm.c > @@ -1160,6 +1160,9 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr, > down_write(¤t->mm->mmap_sem); > if (addr && !(shmflg & SHM_REMAP)) { > err = -EINVAL; > + if (addr + size < addr) > + goto invalid; > + > if (find_vma_intersection(current->mm, addr, addr + size)) > goto invalid; > /* >
Acked-by: Michael Kerrisk <mtk.manpages@gmail.com>
-- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/
| |