diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2013-03-08 15:05:42 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2013-03-08 15:05:42 -0800 |
| commit | 59d8e5eb2bd5593d8220db0e25206cdfc42e83ea (patch) | |
| tree | 5a11524581ff040f2c335fc6a318ff54f100552c /ipc/msg.c | |
| parent | c4c5ff09872751eeb412e3e1af484955529426a1 (diff) | |
| parent | c3d6b628395fe6ec3442a83ddf02334c54867d43 (diff) | |
| download | linux-59d8e5eb2bd5593d8220db0e25206cdfc42e83ea.tar.gz linux-59d8e5eb2bd5593d8220db0e25206cdfc42e83ea.tar.xz | |
Merge branch 'akpm' (fixes from Andrew)
Merge misc fixes from Andrew Morton.
* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
alpha: boot: fix build breakage introduced by system.h disintegration
memcg: initialize kmem-cache destroying work earlier
Randy has moved
ksm: fix m68k build: only NUMA needs pfn_to_nid
dmi_scan: fix missing check for _DMI_ signature in smbios_present()
Revert parts of "hlist: drop the node parameter from iterators"
idr: remove WARN_ON_ONCE() on negative IDs
mm/mempolicy.c: fix sp_node_init() argument ordering
mm/mempolicy.c: fix wrong sp_node insertion
ipc: don't allocate a copy larger than max
ipc: fix potential oops when src msg > 4k w/ MSG_COPY
Diffstat (limited to 'ipc/msg.c')
| -rw-r--r-- | ipc/msg.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/ipc/msg.c b/ipc/msg.c index 950572f9d796..31cd1bf6af27 100644 --- a/ipc/msg.c +++ b/ipc/msg.c @@ -820,15 +820,17 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, struct msg_msg *copy = NULL; unsigned long copy_number = 0; + ns = current->nsproxy->ipc_ns; + if (msqid < 0 || (long) bufsz < 0) return -EINVAL; if (msgflg & MSG_COPY) { - copy = prepare_copy(buf, bufsz, msgflg, &msgtyp, ©_number); + copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax), + msgflg, &msgtyp, ©_number); if (IS_ERR(copy)) return PTR_ERR(copy); } mode = convert_mode(&msgtyp, msgflg); - ns = current->nsproxy->ipc_ns; msq = msg_lock_check(ns, msqid); if (IS_ERR(msq)) { |