From: Ma Wupeng <mawupeng1@xxxxxxxxxx>
Return -EINVAL if len overflows for mbind.
Signed-off-by: Ma Wupeng <mawupeng1@xxxxxxxxxx>
---
mm/mempolicy.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 3a68998adc3a..6b1c45021e48 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1259,6 +1259,7 @@ static long do_mbind(unsigned long start, unsigned long len,
nodemask_t *nmask, unsigned long flags)
{
struct mm_struct *mm = current->mm;
+ unsigned long old_len = len;
struct mempolicy *new;
unsigned long end;
int err;
@@ -1279,7 +1280,7 @@ static long do_mbind(unsigned long start, unsigned long len,
len = PAGE_ALIGN(len);
end = start + len;
- if (end < start)
+ if (end < start || (old_len != 0 && len == 0))
return -EINVAL;
if (end == start)
return 0;
--
2.25.1
