Skip to content
Commit 0f22072a authored by Dan Rosenberg's avatar Dan Rosenberg Committed by Russell King
Browse files

ARM: 6891/1: prevent heap corruption in OABI semtimedop



When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
bound the nsops argument.  A sufficiently large value will cause an
integer overflow in allocation size, followed by copying too much data
into the allocated buffer.  Fix this by restricting nsops to SEMOPM.
Untested.

Cc: stable@kernel.org
Signed-off-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
parent 408133e9
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment