[PATCH] vt: fix possible memory corruption in complement_pos

[linux-2.6] / kernel / sched.c

diff --git a/kernel/sched.c b/kernel/sched.c
index a5fb654ea59071015e6516392444fcc5d41b1153..5f889d0cbfcc2e614aef87963ec0bea5ea6a5f21 100644 (file)
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -3378,8 +3378,8 @@ EXPORT_SYMBOL(set_user_nice);
  */
 int can_nice(const task_t *p, const int nice)
 {
-       /* convert nice value [19,-20] to rlimit style value [0,39] */
-       int nice_rlim = 19 - nice;
+       /* convert nice value [19,-20] to rlimit style value [1,40] */
+       int nice_rlim = 20 - nice;
        return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
                capable(CAP_SYS_NICE));
 }
@@ -3486,7 +3486,7 @@ static void __setscheduler(struct task_struct *p, int policy, int prio)
        p->policy = policy;
        p->rt_priority = prio;
        if (policy != SCHED_NORMAL)
-               p->prio = MAX_USER_RT_PRIO-1 - p->rt_priority;
+               p->prio = MAX_RT_PRIO-1 - p->rt_priority;
        else
                p->prio = p->static_prio;
 }
@@ -3518,7 +3518,8 @@ recheck:
         * 1..MAX_USER_RT_PRIO-1, valid priority for SCHED_NORMAL is 0.
         */
        if (param->sched_priority < 0 ||
-           param->sched_priority > MAX_USER_RT_PRIO-1)
+           (p->mm &&  param->sched_priority > MAX_USER_RT_PRIO-1) ||
+           (!p->mm && param->sched_priority > MAX_RT_PRIO-1))
                return -EINVAL;
        if ((policy == SCHED_NORMAL) != (param->sched_priority == 0))
                return -EINVAL;