diff options
| -rw-r--r-- | ipc/mqueue.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/ipc/mqueue.c b/ipc/mqueue.c index 3c72a05dc326..076399ce363a 100644 --- a/ipc/mqueue.c +++ b/ipc/mqueue.c @@ -676,6 +676,9 @@ static void remove_notification(struct mqueue_inode_info *info) static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr) { + int mq_treesize; + unsigned long total_size; + if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0) return 0; if (capable(CAP_SYS_RESOURCE)) { @@ -690,9 +693,11 @@ static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr) /* check for overflow */ if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg) return 0; - if ((unsigned long)(attr->mq_maxmsg * (attr->mq_msgsize - + sizeof (struct msg_msg *))) < - (unsigned long)(attr->mq_maxmsg * attr->mq_msgsize)) + mq_treesize = attr->mq_maxmsg * sizeof(struct msg_msg) + + min_t(unsigned int, attr->mq_maxmsg, MQ_PRIO_MAX) * + sizeof(struct posix_msg_tree_node); + total_size = attr->mq_maxmsg * attr->mq_msgsize; + if (total_size + mq_treesize < total_size) return 0; return 1; } |