tree 59c175c63787b9b0424c40064df02cda7fe72a24
parent 408133e9dca2b94c64b917b144ec816df913a94e
author Dan Rosenberg <drosenberg@vsecurity.com> 1304088487 +0100
committer Russell King <rmk+kernel@arm.linux.org.uk> 1304088794 +0100

ARM: 6891/1: prevent heap corruption in OABI semtimedop

When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
bound the nsops argument.  A sufficiently large value will cause an
integer overflow in allocation size, followed by copying too much data
into the allocated buffer.  Fix this by restricting nsops to SEMOPM.
Untested.

Cc: stable@kernel.org
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>