From: Miklos Szeredi <[email protected]>
pipe_set_size() needs to copy pipe bufs from the old circular buffer
to the new.
The current code gets this wrong in multiple ways, resulting in oops.
Test program is available here:
http://www.kernel.org/pub/linux/kernel/people/mszeredi/piperesize/
Signed-off-by: Miklos Szeredi <[email protected]>
---
fs/pipe.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
Index: linux.git/fs/pipe.c
===================================================================
--- linux.git.orig/fs/pipe.c 2010-06-08 15:02:16.000000000 +0200
+++ linux.git/fs/pipe.c 2010-06-08 15:50:07.000000000 +0200
@@ -1145,13 +1145,20 @@ static long pipe_set_size(struct pipe_in
* and adjust the indexes.
*/
if (pipe->nrbufs) {
- const unsigned int tail = pipe->nrbufs & (pipe->buffers - 1);
- const unsigned int head = pipe->nrbufs - tail;
+ unsigned int tail;
+ unsigned int head;
+ tail = pipe->curbuf + pipe->nrbufs;
+ if (tail < pipe->buffers)
+ tail = 0;
+ else
+ tail &= (pipe->buffers - 1);
+
+ head = pipe->nrbufs - tail;
if (head)
memcpy(bufs, pipe->bufs + pipe->curbuf, head * sizeof(struct pipe_buffer));
if (tail)
- memcpy(bufs + head, pipe->bufs + pipe->curbuf, tail * sizeof(struct pipe_buffer));
+ memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer));
}
pipe->curbuf = 0;
From: Miklos Szeredi <[email protected]>
As it stands this check compares the number of pages to the page size.
This makes no sense and makes the fcntl fail in almost any sane case.
Fix it by removing the check completely, round_pipe_size() will make
sure that nr_pages >= 1 anyway.
Signed-off-by: Miklos Szeredi <[email protected]>
---
fs/pipe.c | 3 ---
1 file changed, 3 deletions(-)
Index: linux-2.6/fs/pipe.c
===================================================================
--- linux-2.6.orig/fs/pipe.c 2010-06-08 14:14:59.000000000 +0200
+++ linux-2.6/fs/pipe.c 2010-06-08 14:22:45.000000000 +0200
@@ -1211,9 +1211,6 @@ long pipe_fcntl(struct file *file, unsig
if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
ret = -EPERM;
goto out;
- } else if (nr_pages < PAGE_SIZE) {
- ret = -EINVAL;
- goto out;
}
ret = pipe_set_size(pipe, nr_pages);
break;
On Tue, 08 Jun 2010, Miklos Szeredi wrote:
> From: Miklos Szeredi <[email protected]>
>
> As it stands this check compares the number of pages to the page size.
> This makes no sense and makes the fcntl fail in almost any sane case.
>
> Fix it by removing the check completely, round_pipe_size() will make
> sure that nr_pages >= 1 anyway.
Hmm, not quite true. It can actually return zero if round_pipe_size()
overflows unsigned int.
Updated patch below.
Thanks,
Miklos
----
From: Miklos Szeredi <[email protected]>
Subject: pipe: fix check in "set size" fcntl
As it stands this check compares the number of pages to the page size.
This makes no sense and makes the fcntl fail in almost any sane case.
Fix it by checking if nr_pages is not zero (it can become zero only if
arg is too big and round_pipe_size() overflows).
Signed-off-by: Miklos Szeredi <[email protected]>
---
fs/pipe.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
Index: linux-2.6/fs/pipe.c
===================================================================
--- linux-2.6.orig/fs/pipe.c 2010-06-08 16:48:18.000000000 +0200
+++ linux-2.6/fs/pipe.c 2010-06-08 17:12:04.000000000 +0200
@@ -1215,12 +1215,13 @@ long pipe_fcntl(struct file *file, unsig
size = round_pipe_size(arg);
nr_pages = size >> PAGE_SHIFT;
+ ret = -EINVAL;
+ if (!nr_pages)
+ goto out;
+
if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
ret = -EPERM;
goto out;
- } else if (nr_pages < PAGE_SIZE) {
- ret = -EINVAL;
- goto out;
}
ret = pipe_set_size(pipe, nr_pages);
break;
On 2010-06-08 17:14, Miklos Szeredi wrote:
> On Tue, 08 Jun 2010, Miklos Szeredi wrote:
>> From: Miklos Szeredi <[email protected]>
>>
>> As it stands this check compares the number of pages to the page size.
>> This makes no sense and makes the fcntl fail in almost any sane case.
>>
>> Fix it by removing the check completely, round_pipe_size() will make
>> sure that nr_pages >= 1 anyway.
>
> Hmm, not quite true. It can actually return zero if round_pipe_size()
> overflows unsigned int.
>
> Updated patch below.
Thanks, I'll get these tested and merged asap. The copy code
apparently wasn't well tested. And this fcntl() bug snuck in with the
API changes :/
--
Jens Axboe