diff options
| author | Guy Streeter <streeter@redhat.com> | 2007-05-08 09:25:12 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-05-08 20:15:00 +0200 |
| commit | af7c693f146069a1f44739acef9abf1bc27f7247 (patch) | |
| tree | 424f1417dd3c7ace9323aaca4b7b757c8bb7af03 /ipc/compat.c | |
| parent | Use stop_machine_run in the Intel RNG driver (diff) | |
| download | linux-af7c693f146069a1f44739acef9abf1bc27f7247.tar.xz linux-af7c693f146069a1f44739acef9abf1bc27f7247.zip | |
Cap shmmax at INT_MAX in compat shminfo
The value of shmmax may be larger than will fit in the struct used by
the 32bit compat version of sys_shmctl. This change mirrors what the
normal sys_shmctl does when called with the old IPC_INFO command.
Signed-off-by: Guy Streeter <streeter@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'ipc/compat.c')
| -rw-r--r-- | ipc/compat.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/ipc/compat.c b/ipc/compat.c index fa18141539fb..8b44aa9a7c95 100644 --- a/ipc/compat.c +++ b/ipc/compat.c @@ -542,6 +542,8 @@ static inline int put_compat_shminfo64(struct shminfo64 *smi, if (!access_ok(VERIFY_WRITE, up64, sizeof(*up64))) return -EFAULT; + if (smi->shmmax > INT_MAX) + smi->shmmax = INT_MAX; err = __put_user(smi->shmmax, &up64->shmmax); err |= __put_user(smi->shmmin, &up64->shmmin); err |= __put_user(smi->shmmni, &up64->shmmni); @@ -557,6 +559,8 @@ static inline int put_compat_shminfo(struct shminfo64 *smi, if (!access_ok(VERIFY_WRITE, up, sizeof(*up))) return -EFAULT; + if (smi->shmmax > INT_MAX) + smi->shmmax = INT_MAX; err = __put_user(smi->shmmax, &up->shmmax); err |= __put_user(smi->shmmin, &up->shmmin); err |= __put_user(smi->shmmni, &up->shmmni); |