Davidlohr Bueso b567a01552 ipc/shm: fix shmat() nil address after round-down when remapping ... commit 8f89c007b6dec16a1793cb88de88fcc02117bbbc upstream. shmat()'s SHM_REMAP option forbids passing a nil address for; this is in fact the very first thing we check for. Andrea reported that for SHM_RND|SHM_REMAP cases we can end up bypassing the initial addr check, but we need to check again if the address was rounded down to nil. As of this patch, such cases will return -EINVAL. Link: http://lkml.kernel.org/r/20180503204934.kk63josdu6u53fbd@linux-n805 Signed-off-by: Davidlohr Bueso <dbueso@suse.de> Reported-by: Andrea Arcangeli <aarcange@redhat.com> Cc: Joe Lawrence <joe.lawrence@redhat.com> Cc: Manfred Spraul <manfred@colorfullife.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		2019-07-27 21:52:10 +02:00
..
compat.c	ipc: fix compat msgrcv with negative msgtyp	2015-04-19 10:10:50 +02:00
compat_mq.c	ipc: initialize structure memory to zero for compat functions	2010-10-27 18:03:13 -07:00
ipc_sysctl.c	ipc: always handle a new value of auto_msgmni	2014-11-21 09:22:54 -08:00
ipcns_notifier.c
Makefile	Add generic sys_ipc wrapper	2010-03-12 15:52:32 -08:00
mq_sysctl.c	ipc,mqueue: remove limits for the amount of system-wide queues	2014-03-06 21:30:12 -08:00
mqueue.c	mqueue: fix a use-after-free in sys_mq_notify()	2018-05-26 00:39:34 +02:00
msg.c	Initialize msg/shm IPC objects before doing ipc_addid()	2016-05-18 14:32:58 +05:30
msgutil.c	ipc, msg: fix message length check for negative values	2013-12-04 10:56:10 -08:00
namespace.c	ipc: drop ipc_lock_by_ptr	2013-10-18 07:45:48 -07:00
sem.c	Revert "ipc/sem.c: optimize sem_lock()"	2019-07-27 21:42:46 +02:00
shm.c	ipc/shm: fix shmat() nil address after round-down when remapping	2019-07-27 21:52:10 +02:00
syscall.c	get rid of union semop in sys_semctl(2) arguments	2013-03-05 15:14:16 -05:00
util.c	Initialize msg/shm IPC objects before doing ipc_addid()	2016-05-18 14:32:58 +05:30
util.h	ipc, msg: fix message length check for negative values	2013-12-04 10:56:10 -08:00