Commit 9c798bc1 authored by Davidlohr Bueso's avatar Davidlohr Bueso Committed by Greg Kroah-Hartman

ipc/shm: fix shmat() nil address after round-down when remapping

commit 8f89c007 upstream.

shmat()'s SHM_REMAP option forbids passing a nil address for; this is in
fact the very first thing we check for.  Andrea reported that for
SHM_RND|SHM_REMAP cases we can end up bypassing the initial addr check,
but we need to check again if the address was rounded down to nil.  As
of this patch, such cases will return -EINVAL.

Link: default avatarDavidlohr Bueso <>
Reported-by: default avatarAndrea Arcangeli <>
Cc: Joe Lawrence <>
Cc: Manfred Spraul <>
Cc: <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent 2ef44a3c
...@@ -1127,9 +1127,17 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ...@@ -1127,9 +1127,17 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg,
goto out; goto out;
else if ((addr = (ulong)shmaddr)) { else if ((addr = (ulong)shmaddr)) {
if (addr & (shmlba - 1)) { if (addr & (shmlba - 1)) {
if (shmflg & SHM_RND) if (shmflg & SHM_RND) {
addr &= ~(shmlba - 1); /* round down */ addr &= ~(shmlba - 1); /* round down */
* Ensure that the round-down is non-nil
* when remapping. This can happen for
* cases when addr < shmlba.
if (!addr && (shmflg & SHM_REMAP))
goto out;
} else
if (addr & ~PAGE_MASK) if (addr & ~PAGE_MASK)
#endif #endif
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment