Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit af7c693f authored by Guy Streeter's avatar Guy Streeter Committed by Linus Torvalds
Browse files

Cap shmmax at INT_MAX in compat shminfo 



The value of shmmax may be larger than will fit in the struct used by
the 32bit compat version of sys_shmctl. This change mirrors what the
normal sys_shmctl does when called with the old IPC_INFO command.

Signed-off-by: default avatarGuy Streeter <streeter@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent ee527cd3

ipc/compat.c

+4 −0
Original line number Diff line number Diff line
@@ -542,6 +542,8 @@ static inline int put_compat_shminfo64(struct shminfo64 *smi, 


	if (!access_ok(VERIFY_WRITE, up64, sizeof(*up64)))

		return -EFAULT;

	if (smi->shmmax > INT_MAX)

		smi->shmmax = INT_MAX;

	err  = __put_user(smi->shmmax, &up64->shmmax);

	err |= __put_user(smi->shmmin, &up64->shmmin);

	err |= __put_user(smi->shmmni, &up64->shmmni);
@@ -557,6 +559,8 @@ static inline int put_compat_shminfo(struct shminfo64 *smi, 


	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)))

		return -EFAULT;

	if (smi->shmmax > INT_MAX)

		smi->shmmax = INT_MAX;

	err  = __put_user(smi->shmmax, &up->shmmax);

	err |= __put_user(smi->shmmin, &up->shmmin);

	err |= __put_user(smi->shmmni, &up->shmmni);