diff options
| -rw-r--r-- | ipc/shm.c | 8 | ||||
| -rw-r--r-- | mm/mmap.c | 8 |
2 files changed, 13 insertions, 3 deletions
diff --git a/ipc/shm.c b/ipc/shm.c index 34af1fe3470..7e199fa1960 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -493,7 +493,13 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) if (shmflg & SHM_HUGETLB) { struct hstate *hs = hstate_sizelog((shmflg >> SHM_HUGE_SHIFT) & SHM_HUGE_MASK); - size_t hugesize = ALIGN(size, huge_page_size(hs)); + size_t hugesize; + + if (!hs) { + error = -EINVAL; + goto no_file; + } + hugesize = ALIGN(size, huge_page_size(hs)); /* hugetlb_file_setup applies strict accounting */ if (shmflg & SHM_NORESERVE) diff --git a/mm/mmap.c b/mm/mmap.c index 1ae21d645c6..f681e1842fa 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1367,9 +1367,13 @@ SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len, len = ALIGN(len, huge_page_size(hstate_file(file))); } else if (flags & MAP_HUGETLB) { struct user_struct *user = NULL; + struct hstate *hs = hstate_sizelog((flags >> MAP_HUGE_SHIFT) & + SHM_HUGE_MASK); - len = ALIGN(len, huge_page_size(hstate_sizelog( - (flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK))); + if (!hs) + return -EINVAL; + + len = ALIGN(len, huge_page_size(hs)); /* * VM_NORESERVE is used because the reservations will be * taken when vm_ops->mmap() is called |