patch-2.4.8 linux/arch/s390x/kernel/linux32.c

• Lines: 31
• Date: Wed Jul 25 14:12:01 2001
• Orig file: v2.4.7/linux/arch/s390x/kernel/linux32.c
• Orig date: Wed Jul 25 17:10:19 2001

diff -u --recursive --new-file v2.4.7/linux/arch/s390x/kernel/linux32.c linux/arch/s390x/kernel/linux32.c
@@ -32,7 +32,7 @@
 #include <linux/sem.h>
 #include <linux/msg.h>
 #include <linux/shm.h>
-#include <linux/malloc.h>
+#include <linux/slab.h>
 #include <linux/uio.h>
 #include <linux/nfs_fs.h>
 #include <linux/smb_fs.h>
@@ -4176,8 +4176,8 @@
 	unsigned long prot, unsigned long flags,
 	unsigned long fd, unsigned long pgoff)
 {
-	int error = -EBADF;
 	struct file * file = NULL;
+	unsigned long error = -EBADF;
 
 	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
 	if (!(flags & MAP_ANONYMOUS)) {
@@ -4188,6 +4188,11 @@
 
 	down_write(&current->mm->mmap_sem);
 	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
+	if (!IS_ERR((void *) error) && error + len >= 0x80000000ULL) {
+		/* Result is out of bounds.  */
+		do_munmap(current->mm, addr, len);
+		error = -ENOMEM;
+	}
 	up_write(&current->mm->mmap_sem);
 
 	if (file)