Commit 113289cc authored by Doug Ledford's avatar Doug Ledford Committed by Linus Torvalds

ipc/mqueue: strengthen checks on mqueue creation

We already check the mq attr struct if it's passed in, but now that the
admin can set system wide defaults separate from maximums, it's actually
possible to set the defaults to something that would overflow.  So, if
there is no attr struct passed in to the open call, check the default
values.

While we are at it, simplify mq_attr_ok() by making it return 0 or an
error condition, so that way if we add more tests to it later, we have the
option of what error should be returned instead of the calling location
having to pick a possibly inaccurate error code.

[akpm@linux-foundation.org: s/ENOMEM/EOVERFLOW/]
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Manfred Spraul <manfred@colorfullife.com>
Acked-by: default avatarKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 2c12ea49
...@@ -680,26 +680,26 @@ static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr) ...@@ -680,26 +680,26 @@ static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr)
unsigned long total_size; unsigned long total_size;
if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0) if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0)
return 0; return -EINVAL;
if (capable(CAP_SYS_RESOURCE)) { if (capable(CAP_SYS_RESOURCE)) {
if (attr->mq_maxmsg > HARD_MSGMAX || if (attr->mq_maxmsg > HARD_MSGMAX ||
attr->mq_msgsize > HARD_MSGSIZEMAX) attr->mq_msgsize > HARD_MSGSIZEMAX)
return 0; return -EINVAL;
} else { } else {
if (attr->mq_maxmsg > ipc_ns->mq_msg_max || if (attr->mq_maxmsg > ipc_ns->mq_msg_max ||
attr->mq_msgsize > ipc_ns->mq_msgsize_max) attr->mq_msgsize > ipc_ns->mq_msgsize_max)
return 0; return -EINVAL;
} }
/* check for overflow */ /* check for overflow */
if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg) if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg)
return 0; return -EOVERFLOW;
mq_treesize = attr->mq_maxmsg * sizeof(struct msg_msg) + mq_treesize = attr->mq_maxmsg * sizeof(struct msg_msg) +
min_t(unsigned int, attr->mq_maxmsg, MQ_PRIO_MAX) * min_t(unsigned int, attr->mq_maxmsg, MQ_PRIO_MAX) *
sizeof(struct posix_msg_tree_node); sizeof(struct posix_msg_tree_node);
total_size = attr->mq_maxmsg * attr->mq_msgsize; total_size = attr->mq_maxmsg * attr->mq_msgsize;
if (total_size + mq_treesize < total_size) if (total_size + mq_treesize < total_size)
return 0; return -EOVERFLOW;
return 1; return 0;
} }
/* /*
...@@ -714,12 +714,21 @@ static struct file *do_create(struct ipc_namespace *ipc_ns, struct dentry *dir, ...@@ -714,12 +714,21 @@ static struct file *do_create(struct ipc_namespace *ipc_ns, struct dentry *dir,
int ret; int ret;
if (attr) { if (attr) {
if (!mq_attr_ok(ipc_ns, attr)) { ret = mq_attr_ok(ipc_ns, attr);
ret = -EINVAL; if (ret)
goto out; goto out;
}
/* store for use during create */ /* store for use during create */
dentry->d_fsdata = attr; dentry->d_fsdata = attr;
} else {
struct mq_attr def_attr;
def_attr.mq_maxmsg = min(ipc_ns->mq_msg_max,
ipc_ns->mq_msg_default);
def_attr.mq_msgsize = min(ipc_ns->mq_msgsize_max,
ipc_ns->mq_msgsize_default);
ret = mq_attr_ok(ipc_ns, &def_attr);
if (ret)
goto out;
} }
mode &= ~current_umask(); mode &= ~current_umask();
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment