summaryrefslogtreecommitdiffstats
path: root/ipc
diff options
context:
space:
mode:
authorDavidlohr Bueso <dave@stgolabs.net>2018-05-25 14:47:30 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-05-30 07:50:17 +0200
commit9c798bc19e1b42ca7ece9523fcb6a6751f689561 (patch)
tree00eaa149d0e9ad3be0848e6b3001236619329e3d /ipc
parent2ef44a3c1a32656dbae30cd16ec5c22a996a4ca9 (diff)
downloadlinux-stable-9c798bc19e1b42ca7ece9523fcb6a6751f689561.tar.gz
linux-stable-9c798bc19e1b42ca7ece9523fcb6a6751f689561.tar.bz2
linux-stable-9c798bc19e1b42ca7ece9523fcb6a6751f689561.zip
ipc/shm: fix shmat() nil address after round-down when remapping
commit 8f89c007b6dec16a1793cb88de88fcc02117bbbc upstream. shmat()'s SHM_REMAP option forbids passing a nil address for; this is in fact the very first thing we check for. Andrea reported that for SHM_RND|SHM_REMAP cases we can end up bypassing the initial addr check, but we need to check again if the address was rounded down to nil. As of this patch, such cases will return -EINVAL. Link: http://lkml.kernel.org/r/20180503204934.kk63josdu6u53fbd@linux-n805 Signed-off-by: Davidlohr Bueso <dbueso@suse.de> Reported-by: Andrea Arcangeli <aarcange@redhat.com> Cc: Joe Lawrence <joe.lawrence@redhat.com> Cc: Manfred Spraul <manfred@colorfullife.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'ipc')
-rw-r--r--ipc/shm.c12
1 files changed, 10 insertions, 2 deletions
diff --git a/ipc/shm.c b/ipc/shm.c
index 32b65f7a2dba..9c687cda9b0a 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1127,9 +1127,17 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg,
goto out;
else if ((addr = (ulong)shmaddr)) {
if (addr & (shmlba - 1)) {
- if (shmflg & SHM_RND)
+ if (shmflg & SHM_RND) {
addr &= ~(shmlba - 1); /* round down */
- else
+
+ /*
+ * Ensure that the round-down is non-nil
+ * when remapping. This can happen for
+ * cases when addr < shmlba.
+ */
+ if (!addr && (shmflg & SHM_REMAP))
+ goto out;
+ } else
#ifndef __ARCH_FORCE_SHMLBA
if (addr & ~PAGE_MASK)
#endif