| commit | f40fe91c33e4990ad4308fc964c79e1c70a75194 | |
| author | Dan Rosenberg <drosenberg@vsecurity.com> | |
| Fri, 29 Apr 2011 14:48:07 +0000 (29 15:48 +0100) | ||
| committer | Greg Kroah-Hartman <gregkh@suse.de> | |
| Mon, 9 May 2011 22:54:58 +0000 (9 15:54 -0700) | ||
| tree | 04679280e6349d12d3007f88b5d4977088f42924 | treesnapshot (tar.gz zip) |
| parent | 1edf9b933cf1d30983f9a637962b46cd988a8280 | commitdiff |
ARM: 6891/1: prevent heap corruption in OABI semtimedop
commit 0f22072ab50cac7983f9660d33974b45184da4f9 upstream.
When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
bound the nsops argument. A sufficiently large value will cause an
integer overflow in allocation size, followed by copying too much data
into the allocated buffer. Fix this by restricting nsops to SEMOPM.
Untested.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 0f22072ab50cac7983f9660d33974b45184da4f9 upstream.
When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
bound the nsops argument. A sufficiently large value will cause an
integer overflow in allocation size, followed by copying too much data
into the allocated buffer. Fix this by restricting nsops to SEMOPM.
Untested.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| arch/arm/kernel/sys_oabi-compat.c | diffblobblamehistory |