From dd585f2a27a45f3a6ec2741e459cd5ef73e26fcd Mon Sep 17 00:00:00 2001 From: Manfred Spraul Date: Thu, 22 May 2014 10:44:16 +1000 Subject: [PATCH] ipc/shm.c: check for overflows of shm_tot shm_tot counts the total number of pages used by shm segments. If SHMALL is ULONG_MAX (or nearly ULONG_MAX), then the number can overflow. Subsequent calls to shmctl(,SHM_INFO,) would return wrong values for shm_tot. The patch adds a detection for overflows. Signed-off-by: Manfred Spraul Acked-by: Davidlohr Bueso Acked-by: KOSAKI Motohiro Acked-by: Michael Kerrisk Signed-off-by: Andrew Morton --- ipc/shm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ipc/shm.c b/ipc/shm.c index dda8f1ff3c35..9e51bf246344 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -493,7 +493,8 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) if (size < SHMMIN || size > ns->shm_ctlmax) return -EINVAL; - if (ns->shm_tot + numpages > ns->shm_ctlall) + if (ns->shm_tot + numpages < ns->shm_tot || + ns->shm_tot + numpages > ns->shm_ctlall) return -ENOSPC; shp = ipc_rcu_alloc(sizeof(*shp)); -- 2.39.5