linux-kernel - Re: [PATCH 2/2] pipe: remove bogus check from "set size" fcntl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 08 Jun 2010 17:14:43 +0200
From:	Miklos Szeredi <miklos@...redi.hu>
To:	jens.axboe@...cle.com
CC:	akpm@...ux-foundation.org, torvalds@...ux-foundation.org,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] pipe: remove bogus check from "set size" fcntl

On Tue, 08 Jun 2010, Miklos Szeredi wrote:
> From: Miklos Szeredi <mszeredi@...e.cz>
> 
> As it stands this check compares the number of pages to the page size.
> This makes no sense and makes the fcntl fail in almost any sane case.
> 
> Fix it by removing the check completely, round_pipe_size() will make
> sure that nr_pages >= 1 anyway.

Hmm, not quite true.  It can actually return zero if round_pipe_size()
overflows unsigned int.

Updated patch below.

Thanks,
Miklos
----

From: Miklos Szeredi <mszeredi@...e.cz>
Subject: pipe: fix check in "set size" fcntl

As it stands this check compares the number of pages to the page size.
This makes no sense and makes the fcntl fail in almost any sane case.

Fix it by checking if nr_pages is not zero (it can become zero only if
arg is too big and round_pipe_size() overflows).

Signed-off-by: Miklos Szeredi <mszeredi@...e.cz>
---
 fs/pipe.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

Index: linux-2.6/fs/pipe.c
===================================================================
--- linux-2.6.orig/fs/pipe.c	2010-06-08 16:48:18.000000000 +0200
+++ linux-2.6/fs/pipe.c	2010-06-08 17:12:04.000000000 +0200
@@ -1215,12 +1215,13 @@ long pipe_fcntl(struct file *file, unsig
 		size = round_pipe_size(arg);
 		nr_pages = size >> PAGE_SHIFT;
 
+		ret = -EINVAL;
+		if (!nr_pages)
+			goto out;
+
 		if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
 			ret = -EPERM;
 			goto out;
-		} else if (nr_pages < PAGE_SIZE) {
-			ret = -EINVAL;
-			goto out;
 		}
 		ret = pipe_set_size(pipe, nr_pages);
 		break;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/