From 09c6eb1f651dad601f02435bbd79734954960c42 Mon Sep 17 00:00:00 2001 From: Manfred Spraul Date: Fri, 6 Jun 2014 14:37:40 -0700 Subject: [PATCH] ipc/shm.c: check for overflows of shm_tot shm_tot counts the total number of pages used by shm segments. If SHMALL is ULONG_MAX (or nearly ULONG_MAX), then the number can overflow. Subsequent calls to shmctl(,SHM_INFO,) would return wrong values for shm_tot. The patch adds a detection for overflows. Signed-off-by: Manfred Spraul Acked-by: Davidlohr Bueso Acked-by: KOSAKI Motohiro Acked-by: Michael Kerrisk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- ipc/shm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ipc/shm.c b/ipc/shm.c index dda8f1ff3c35..9e51bf246344 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -493,7 +493,8 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) if (size < SHMMIN || size > ns->shm_ctlmax) return -EINVAL; - if (ns->shm_tot + numpages > ns->shm_ctlall) + if (ns->shm_tot + numpages < ns->shm_tot || + ns->shm_tot + numpages > ns->shm_ctlall) return -ENOSPC; shp = ipc_rcu_alloc(sizeof(*shp)); -- 2.20.1