diff options
-rw-r--r-- | ipc/compat.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/ipc/compat.c b/ipc/compat.c index fa18141539fb..8b44aa9a7c95 100644 --- a/ipc/compat.c +++ b/ipc/compat.c | |||
@@ -542,6 +542,8 @@ static inline int put_compat_shminfo64(struct shminfo64 *smi, | |||
542 | 542 | ||
543 | if (!access_ok(VERIFY_WRITE, up64, sizeof(*up64))) | 543 | if (!access_ok(VERIFY_WRITE, up64, sizeof(*up64))) |
544 | return -EFAULT; | 544 | return -EFAULT; |
545 | if (smi->shmmax > INT_MAX) | ||
546 | smi->shmmax = INT_MAX; | ||
545 | err = __put_user(smi->shmmax, &up64->shmmax); | 547 | err = __put_user(smi->shmmax, &up64->shmmax); |
546 | err |= __put_user(smi->shmmin, &up64->shmmin); | 548 | err |= __put_user(smi->shmmin, &up64->shmmin); |
547 | err |= __put_user(smi->shmmni, &up64->shmmni); | 549 | err |= __put_user(smi->shmmni, &up64->shmmni); |
@@ -557,6 +559,8 @@ static inline int put_compat_shminfo(struct shminfo64 *smi, | |||
557 | 559 | ||
558 | if (!access_ok(VERIFY_WRITE, up, sizeof(*up))) | 560 | if (!access_ok(VERIFY_WRITE, up, sizeof(*up))) |
559 | return -EFAULT; | 561 | return -EFAULT; |
562 | if (smi->shmmax > INT_MAX) | ||
563 | smi->shmmax = INT_MAX; | ||
560 | err = __put_user(smi->shmmax, &up->shmmax); | 564 | err = __put_user(smi->shmmax, &up->shmmax); |
561 | err |= __put_user(smi->shmmin, &up->shmmin); | 565 | err |= __put_user(smi->shmmin, &up->shmmin); |
562 | err |= __put_user(smi->shmmni, &up->shmmni); | 566 | err |= __put_user(smi->shmmni, &up->shmmni); |