Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 88b9e456 authored by Peter Hurley's avatar Peter Hurley Committed by Linus Torvalds
Browse files

ipc: don't allocate a copy larger than max 



When MSG_COPY is set, a duplicate message must be allocated for the copy
before locking the queue.  However, the copy could not be larger than was
sent which is limited to msg_ctlmax.

Signed-off-by: default avatarPeter Hurley <peter@hurleysoftware.com>
Acked-by: default avatarStanislav Kinsbursky <skinsbursky@parallels.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent e1082f45

ipc/msg.c

+4 −2
Original line number Diff line number Diff line
@@ -820,15 +820,17 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, 
	struct msg_msg *copy = NULL;

	unsigned long copy_number = 0;



	ns = current->nsproxy->ipc_ns;



	if (msqid < 0 || (long) bufsz < 0)

		return -EINVAL;

	if (msgflg & MSG_COPY) {

		copy = prepare_copy(buf, bufsz, msgflg, &msgtyp, &copy_number);

		copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax),

				    msgflg, &msgtyp, &copy_number);

		if (IS_ERR(copy))

			return PTR_ERR(copy);

	}

	mode = convert_mode(&msgtyp, msgflg);

	ns = current->nsproxy->ipc_ns;



	msq = msg_lock_check(ns, msqid);

	if (IS_ERR(msq)) {