Bluetooth: Change hci_conn_params_add to return the parameter struct

[pandora-kernel.git] / ipc / shm.c

diff --git a/ipc/shm.c b/ipc/shm.c
index 2b64b0d..89fc354 100644 (file)
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -493,7 +493,11 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
        if (size < SHMMIN || size > ns->shm_ctlmax)
                return -EINVAL;
 
-       if (ns->shm_tot + numpages > ns->shm_ctlall)
+       if (numpages << PAGE_SHIFT < size)
+               return -ENOSPC;
+
+       if (ns->shm_tot + numpages < ns->shm_tot ||
+                       ns->shm_tot + numpages > ns->shm_ctlall)
                return -ENOSPC;
 
        shp = ipc_rcu_alloc(sizeof(*shp));
@@ -1160,6 +1164,9 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
        down_write(&current->mm->mmap_sem);
        if (addr && !(shmflg & SHM_REMAP)) {
                err = -EINVAL;
+               if (addr + size < addr)
+                       goto invalid;
+
                if (find_vma_intersection(current->mm, addr, addr + size))
                        goto invalid;
                /*