From patchwork Sat Aug 25 06:05:53 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xi Wang X-Patchwork-Id: 179951 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 6F7BB2C00F6 for ; Sat, 25 Aug 2012 16:07:03 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751234Ab2HYGGR (ORCPT ); Sat, 25 Aug 2012 02:06:17 -0400 Received: from mail-vc0-f174.google.com ([209.85.220.174]:37291 "EHLO mail-vc0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750788Ab2HYGGQ (ORCPT ); Sat, 25 Aug 2012 02:06:16 -0400 Received: by vcbfk26 with SMTP id fk26so2929471vcb.19 for ; Fri, 24 Aug 2012 23:06:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer; bh=ziag8tP618eO+zeSfry3V65xHw5OkUv3lJC7hKPx6bs=; b=BXh/xxaw3/nhSJSewUhuSryK6E7lXoZN6wN4zLixy1QrAmoRW6f4K+4jd1NN792DIQ 1EPkooNsHNBluqCN+vL8bBeLPGkVgrb/5Gl+hho8qm0l/qebJSllQcMXNg/Lv28zUM1Y B+vFODCHRblogVtpLiRGSQB059giyor11c0QMOz7yjQcB1sGd7sMfvPuLJpleruJdg69 WbI77jd/uXH4Rz0LhGoZ2UfSoygatMyCTGfaPYMOdSLY6SxO+g09vcJSUicCIUIqSkaG dVtHjmpqbHWGw5WDRJULCsPVlL/EKkTvyQCAX/1OoUM11Z4EVxmG7jqdsG1DR1BndNLf Z95g== Received: by 10.59.7.68 with SMTP id da4mr7212216ved.4.1345874775540; Fri, 24 Aug 2012 23:06:15 -0700 (PDT) Received: from hchen.lcs.mit.edu (hchen.csail.mit.edu. [18.26.5.5]) by mx.google.com with ESMTPS id dt8sm5693916vec.3.2012.08.24.23.06.14 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 24 Aug 2012 23:06:15 -0700 (PDT) From: Xi Wang To: netdev@vger.kernel.org Cc: "David S. Miller" , Xi Wang , Eric Dumazet Subject: [PATCH] af_unix: fix unix_nr_socks check in unix_create1() Date: Sat, 25 Aug 2012 02:05:53 -0400 Message-Id: <1345874753-7214-1-git-send-email-xi.wang@gmail.com> X-Mailer: git-send-email 1.7.9.5 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This patch complements 518de9b3 ("fs: allow for more than 2^31 files"). get_max_files() returns files_stat.max_files, which can be set to any value from user space via /proc/sys/fs/file-max. A large file-max will cause an integer overflow in the following check: if (atomic_long_read(&unix_nr_socks) > 2 * get_max_files()) goto out; The kernel will then fail to create a unix domain socket. Rewrite the check using "/ 2" on the left-hand side. Signed-off-by: Xi Wang Cc: Eric Dumazet --- net/unix/af_unix.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index c5ee4ff..99a8bc9 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -630,9 +630,9 @@ static struct sock *unix_create1(struct net *net, struct socket *sock) { struct sock *sk = NULL; struct unix_sock *u; + unsigned long nr_socks = atomic_long_inc_return(&unix_nr_socks); - atomic_long_inc(&unix_nr_socks); - if (atomic_long_read(&unix_nr_socks) > 2 * get_max_files()) + if (nr_socks / 2 > get_max_files()) goto out; sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_proto);