Cap shmmax at INT_MAX in compat shminfo
authorGuy Streeter <streeter@redhat.com>
Tue, 8 May 2007 07:25:12 +0000 (00:25 -0700)
committerLinus Torvalds <torvalds@woody.linux-foundation.org>
Tue, 8 May 2007 18:15:00 +0000 (11:15 -0700)
The value of shmmax may be larger than will fit in the struct used by
the 32bit compat version of sys_shmctl. This change mirrors what the
normal sys_shmctl does when called with the old IPC_INFO command.

Signed-off-by: Guy Streeter <streeter@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
ipc/compat.c

index fa18141539fb38d4f6980c5b1f74b4c4dafa66e9..8b44aa9a7c95dd928b2a4125d23381a3c1edcede 100644 (file)
@@ -542,6 +542,8 @@ static inline int put_compat_shminfo64(struct shminfo64 *smi,
 
        if (!access_ok(VERIFY_WRITE, up64, sizeof(*up64)))
                return -EFAULT;
+       if (smi->shmmax > INT_MAX)
+               smi->shmmax = INT_MAX;
        err  = __put_user(smi->shmmax, &up64->shmmax);
        err |= __put_user(smi->shmmin, &up64->shmmin);
        err |= __put_user(smi->shmmni, &up64->shmmni);
@@ -557,6 +559,8 @@ static inline int put_compat_shminfo(struct shminfo64 *smi,
 
        if (!access_ok(VERIFY_WRITE, up, sizeof(*up)))
                return -EFAULT;
+       if (smi->shmmax > INT_MAX)
+               smi->shmmax = INT_MAX;
        err  = __put_user(smi->shmmax, &up->shmmax);
        err |= __put_user(smi->shmmin, &up->shmmin);
        err |= __put_user(smi->shmmni, &up->shmmni);