[PATCH] sys_mbind sanity checking

Make sure maxnodes is safe size before calculating nlongs in
get_nodes().

Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 323fdcf128c407a77719436a2c4b49a420a521e6..bedfa4f09c8072d65b50df55a25af7fa0ec21c1e 100644 (file)
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -808,6 +808,8 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask,
        nodes_clear(*nodes);
        if (maxnode == 0 || !nmask)
                return 0;
+       if (maxnode > PAGE_SIZE)
+               return -EINVAL;
 
        nlongs = BITS_TO_LONGS(maxnode);
        if ((maxnode % BITS_PER_LONG) == 0)