Dan Rosenberg f40fe91c33 ARM: 6891/1: prevent heap corruption in OABI semtimedop ...

commit 0f22072ab5 upstream.

When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
bound the nsops argument.  A sufficiently large value will cause an
integer overflow in allocation size, followed by copying too much data
into the allocated buffer.  Fix this by restricting nsops to SEMOPM.
Untested.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2011-05-09 15:54:58 -07:00

..

.gitignore

…

armksyms.c

…

arthur.c

…

asm-offsets.c

…

atags.c

…

atags.h

…

bios32.c

…

calls.S

untangle the do_mremap() mess

2010-01-18 10:19:11 -08:00

compat.c

…

compat.h

…

crunch-bits.S

…

crunch.c

…

debug.S

…

dma-isa.c

…

dma.c

…

ecard.c

…

ecard.h

…

elf.c

…

entry-armv.S

…

entry-common.S

arm: fix really nasty sigreturn bug

2010-09-20 13:18:12 -07:00

entry-header.S

…

fiq.c

…

ftrace.c

…

head-common.S

…

head-nommu.S

…

head.S

…

init_task.c

…

io.c

…

irq.c

…

isa.c

…

iwmmxt.S

…

kgdb.c

…

kprobes-decode.c

ARM: 6226/1: fix kprobe bug in ldr instruction emulation

2010-08-02 10:21:02 -07:00

kprobes.c

…

machine_kexec.c

…

Makefile

…

module.c

…

process.c

…

ptrace.c

…

ptrace.h

…

relocate_kernel.S

…

return_address.c

…

setup.c

…

signal.c

ARM: Ensure predictable endian state on signal handler entry

2011-03-02 09:46:52 -05:00

signal.h

…

smp_scu.c

…

smp_twd.c

…

smp.c

…

stacktrace.c

…

sys_arm.c

untangle the do_mremap() mess

2010-01-18 10:19:11 -08:00

sys_oabi-compat.c

ARM: 6891/1: prevent heap corruption in OABI semtimedop

2011-05-09 15:54:58 -07:00

tcm.c

…

tcm.h

…

thumbee.c

…

time.c

…

traps.c

…

unwind.c

…

vmlinux.lds.S

…

xscale-cp0.c

…