lkml.org 
[lkml]   [2018]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 213/410] pipe: fix off-by-one error when checking buffer limits
    3.16.57-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Biggers <ebiggers@google.com>

    commit 9903a91c763ecdae333a04a9d89d79d2b8966503 upstream.

    With pipe-user-pages-hard set to 'N', users were actually only allowed up
    to 'N - 1' buffers; and likewise for pipe-user-pages-soft.

    Fix this to allow up to 'N' buffers, as would be expected.

    Link: http://lkml.kernel.org/r/20180111052902.14409-5-ebiggers3@gmail.com
    Fixes: b0b91d18e2e9 ("pipe: fix limit checking in pipe_set_size()")
    Signed-off-by: Eric Biggers <ebiggers@google.com>
    Acked-by: Willy Tarreau <w@1wt.eu>
    Acked-by: Kees Cook <keescook@chromium.org>
    Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: "Luis R . Rodriguez" <mcgrof@kernel.org>
    Cc: Michael Kerrisk <mtk.manpages@gmail.com>
    Cc: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    fs/pipe.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/fs/pipe.c
    +++ b/fs/pipe.c
    @@ -593,12 +593,12 @@ static unsigned long account_pipe_buffer

    static bool too_many_pipe_buffers_soft(unsigned long user_bufs)
    {
    - return pipe_user_pages_soft && user_bufs >= pipe_user_pages_soft;
    + return pipe_user_pages_soft && user_bufs > pipe_user_pages_soft;
    }

    static bool too_many_pipe_buffers_hard(unsigned long user_bufs)
    {
    - return pipe_user_pages_hard && user_bufs >= pipe_user_pages_hard;
    + return pipe_user_pages_hard && user_bufs > pipe_user_pages_hard;
    }

    static bool is_unprivileged_user(void)
    \
     
     \ /
      Last update: 2018-06-07 16:41    [W:2.049 / U:0.168 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site