[PATCH] do_brk() bounds checking

check that the brk value lies in bounds.

diff --git a/mm/mmap.c b/mm/mmap.c
index 61c9f5ca5f829860053b2b964551d024ab620829..eae068ccdae132be9bc146f7942222b9175c0054 100644 (file)
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1269,6 +1269,9 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
        if (!len)
                return addr;
 
+       if ((addr + len) > TASK_SIZE || (addr + len) < addr)
+               return -EINVAL;
+
        /*
         * mlock MCL_FUTURE?
         */