linux-kernel - [PATCH 05/44] ipc/msg: Fix saturation of percpu counts in msgctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251119224140.8616-6-david.laight.linux@gmail.com>
Date: Wed, 19 Nov 2025 22:41:01 +0000
From: david.laight.linux@...il.com
To: linux-kernel@...r.kernel.org
Cc: David Laight <david.laight.linux@...il.com>
Subject: [PATCH 05/44] ipc/msg: Fix saturation of percpu counts in msgctl_info()

From: David Laight <david.laight.linux@...il.com>

While the percpu_counter_sum() values are unlikely to be large the code
tries to saturate them using min_t(int, percpu_counter_sum(), INT_MAX)
This just doesn't work since the high bits are all masked and then the
(possibly negative) value assigned.

Replace the min_t() with a plain min().

Fixes: 72d1e611082ed ("ipc/msg: mitigate the lock contention with percpu counter")
Signed-off-by: David Laight <david.laight.linux@...il.com>
---
 ipc/msg.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/ipc/msg.c b/ipc/msg.c
index ee6af4fe52bf..34e607add006 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -501,11 +501,9 @@ static int msgctl_info(struct ipc_namespace *ns, int msqid,
 	max_idx = ipc_get_maxidx(&msg_ids(ns));
 	up_read(&msg_ids(ns).rwsem);
 	if (cmd == MSG_INFO) {
-		msginfo->msgmap = min_t(int,
-				     percpu_counter_sum(&ns->percpu_msg_hdrs),
+		msginfo->msgmap = min(percpu_counter_sum(&ns->percpu_msg_hdrs),
 				     INT_MAX);
-		msginfo->msgtql = min_t(int,
-		                     percpu_counter_sum(&ns->percpu_msg_bytes),
+		msginfo->msgtql = min(percpu_counter_sum(&ns->percpu_msg_bytes),
 				     INT_MAX);
 	} else {
 		msginfo->msgmap = MSGMAP;
-- 
2.39.5