diff options
| author | K Prateek Nayak <kprateek.nayak@amd.com> | 2025-03-07 05:29:16 +0000 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2025-03-10 08:55:05 +0100 |
| commit | cf3d0c54b21c4a351d4f94cf188e9715dbd1ef5b (patch) | |
| tree | 3d4a2fe9c20d3ed3e3000925f499cd7f6987887e /fs/pipe.c | |
| parent | 00a7d39898c8010bfd5ff62af31ca5db34421b38 (diff) | |
fs/pipe: Limit the slots in pipe_resize_ring()
Limit the number of slots in pipe_resize_ring() to the maximum value
representable by pipe->{head,tail}. Values beyond the max limit can
lead to incorrect pipe occupancy related calculations where the pipe
will never appear full.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: K Prateek Nayak <kprateek.nayak@amd.com>
Link: https://lore.kernel.org/r/20250307052919.34542-2-kprateek.nayak@amd.com
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'fs/pipe.c')
| -rw-r--r-- | fs/pipe.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/pipe.c b/fs/pipe.c index 4d0799e4e719..88e81f84e3ea 100644 --- a/fs/pipe.c +++ b/fs/pipe.c @@ -1271,6 +1271,10 @@ int pipe_resize_ring(struct pipe_inode_info *pipe, unsigned int nr_slots) struct pipe_buffer *bufs; unsigned int head, tail, mask, n; + /* nr_slots larger than limits of pipe->{head,tail} */ + if (unlikely(nr_slots > (pipe_index_t)-1u)) + return -EINVAL; + bufs = kcalloc(nr_slots, sizeof(*bufs), GFP_KERNEL_ACCOUNT | __GFP_NOWARN); if (unlikely(!bufs)) |