diff mbox

[4/7] pipe: fix off-by-one error when checking buffer limits

Message ID 20180108053542.6472-5-ebiggers3@gmail.com (mailing list archive)
State New, archived
Headers show

Commit Message

Eric Biggers Jan. 8, 2018, 5:35 a.m. UTC
From: Eric Biggers <ebiggers@google.com>

With pipe-user-pages-hard set to 'N', users were actually only allowed
up to 'N - 1' buffers; and likewise for pipe-user-pages-soft.

Fix this to allow up to 'N' buffers, as would be expected.

Signed-off-by: Eric Biggers <ebiggers@google.com>
---
 fs/pipe.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Willy Tarreau Jan. 8, 2018, 6:42 a.m. UTC | #1
On Sun, Jan 07, 2018 at 09:35:39PM -0800, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
> 
> With pipe-user-pages-hard set to 'N', users were actually only allowed
> up to 'N - 1' buffers; and likewise for pipe-user-pages-soft.
> 
> Fix this to allow up to 'N' buffers, as would be expected.

Interesting. I was a bit surprized at first and found that this was
changed by b0b91d1 ("pipe: fix limit checking in pipe_set_size()").
Prior to this fix, only already allocated pipes were counted. After
the fix, an allocation attempt was made before checking the size. So
I think that your fix is needed in stable versions which backported
the commit above.

> Signed-off-by: Eric Biggers <ebiggers@google.com>

Acked-by: Willy Tarreau <w@1wt.eu>

Thanks,
Willy
diff mbox

Patch

diff --git a/fs/pipe.c b/fs/pipe.c
index 847ecc388820..9f20e7128578 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -605,12 +605,12 @@  static unsigned long account_pipe_buffers(struct user_struct *user,
 
 static bool too_many_pipe_buffers_soft(unsigned long user_bufs)
 {
-	return pipe_user_pages_soft && user_bufs >= pipe_user_pages_soft;
+	return pipe_user_pages_soft && user_bufs > pipe_user_pages_soft;
 }
 
 static bool too_many_pipe_buffers_hard(unsigned long user_bufs)
 {
-	return pipe_user_pages_hard && user_bufs >= pipe_user_pages_hard;
+	return pipe_user_pages_hard && user_bufs > pipe_user_pages_hard;
 }
 
 static bool is_unprivileged_user(void)