Skip to content

Commit 2ccd4f4

Browse files
sashalevintorvalds
authored andcommitted
pipe: fail cleanly when root tries F_SETPIPE_SZ with big size
When a user with the CAP_SYS_RESOURCE cap tries to F_SETPIPE_SZ a pipe with size bigger than kmalloc() can alloc it spits out an ugly warning: ------------[ cut here ]------------ WARNING: at mm/page_alloc.c:2095 __alloc_pages_nodemask+0x5d3/0x7a0() Pid: 733, comm: a.out Not tainted 3.2.0-rc1+ #4 Call Trace: warn_slowpath_common+0x75/0xb0 warn_slowpath_null+0x15/0x20 __alloc_pages_nodemask+0x5d3/0x7a0 __get_free_pages+0x12/0x50 __kmalloc+0x12b/0x150 pipe_set_size+0x75/0x120 pipe_fcntl+0xf8/0x140 do_fcntl+0x2d4/0x410 sys_fcntl+0x66/0xa0 system_call_fastpath+0x16/0x1b ---[ end trace 432f702e6db7b5ee ]--- Instead, make kcalloc() handle the overflow case and fail quietly. [[email protected]: switch to sizeof(*bufs) for 80-column niceness] Signed-off-by: Sasha Levin <[email protected]> Cc: Alexander Viro <[email protected]> Acked-by: Pekka Enberg <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
1 parent 888a214 commit 2ccd4f4

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

fs/pipe.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1137,7 +1137,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
11371137
if (nr_pages < pipe->nrbufs)
11381138
return -EBUSY;
11391139

1140-
bufs = kcalloc(nr_pages, sizeof(struct pipe_buffer), GFP_KERNEL);
1140+
bufs = kcalloc(nr_pages, sizeof(*bufs), GFP_KERNEL | __GFP_NOWARN);
11411141
if (unlikely(!bufs))
11421142
return -ENOMEM;
11431143

0 commit comments

Comments
 (0)