Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2c12ea49 authored by Doug Ledford's avatar Doug Ledford Committed by Linus Torvalds
Browse files

ipc/mqueue: correct mq_attr_ok test 



While working on the other parts of the mqueue stuff, I noticed that the
calculation for overflow in mq_attr_ok didn't actually match reality (this
is especially true since my last patch which changed how we account memory
slightly).

In particular, we used to test for overflow using:
  msgs * msgsize + msgs * sizeof(struct msg_msg *)

That was never really correct because each message we allocate via
load_msg() is actually a struct msg_msg followed by the data for the
message (and if struct msg_msg + data exceeds PAGE_SIZE we end up
allocating struct msg_msgseg structs too, but accounting for them would
get really tedious, so let's ignore those...they're only a pointer in size
anyway).  This patch updates the calculation to be more accurate in
regards to maximum possible memory consumption by the mqueue.

[akpm@linux-foundation.org: add a local to simplify overflow-checking expression]
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Manfred Spraul <manfred@colorfullife.com>
Acked-by: default avatarKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent d6629859

ipc/mqueue.c

+8 −3
Original line number Diff line number Diff line
@@ -676,6 +676,9 @@ static void remove_notification(struct mqueue_inode_info *info) 


static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr)

{

	int mq_treesize;

	unsigned long total_size;



	if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0)

		return 0;

	if (capable(CAP_SYS_RESOURCE)) {
@@ -690,9 +693,11 @@ static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr) 
	/* check for overflow */

	if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg)

		return 0;

	if ((unsigned long)(attr->mq_maxmsg * (attr->mq_msgsize

	    + sizeof (struct msg_msg *))) <

	    (unsigned long)(attr->mq_maxmsg * attr->mq_msgsize))

	mq_treesize = attr->mq_maxmsg * sizeof(struct msg_msg) +

		min_t(unsigned int, attr->mq_maxmsg, MQ_PRIO_MAX) *

		sizeof(struct posix_msg_tree_node);

	total_size = attr->mq_maxmsg * attr->mq_msgsize;

	if (total_size + mq_treesize < total_size)

		return 0;

	return 1;

}