Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753079AbbGKGwY (ORCPT ); Sat, 11 Jul 2015 02:52:24 -0400 Received: from zeniv.linux.org.uk ([195.92.253.2]:51574 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751602AbbGKGwX (ORCPT ); Sat, 11 Jul 2015 02:52:23 -0400 Date: Sat, 11 Jul 2015 03:03:00 +0100 From: Al Viro To: Davidlohr Bueso Cc: Marcus Gelderie , mtk.manpages@gmail.com, Doug Ledford , lkml , David Howells , John Duffy , Arto Bendiken , Linux API , akpm@linux-foundation.org Subject: Re: [PATCH 2/1] ipc,mqueue: Delete bogus overflow check Message-ID: <20150711020300.GH17109@ZenIV.linux.org.uk> References: <20150622222546.GA32432@ramsey.localdomain> <1435211229.11852.23.camel@stgolabs.net> <1435256484.11852.30.camel@stgolabs.net> <20150706154928.GA19828@ramsey.localdomain> <1436575691.27924.53.camel@stgolabs.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1436575691.27924.53.camel@stgolabs.net> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1577 Lines: 32 On Fri, Jul 10, 2015 at 05:48:11PM -0700, Davidlohr Bueso wrote: > Mathematically, returning -EOVERFLOW in mq_attr_ok() > cannot occur under this condition: > > mq_treesize = attr->mq_maxmsg * sizeof(struct msg_msg) + > min_t(unsigned int, attr->mq_maxmsg, MQ_PRIO_MAX) * > sizeof(struct posix_msg_tree_node); > total_size = attr->mq_maxmsg * attr->mq_msgsize; > if (total_size + mq_treesize < total_size) > return -EOVERFLOW; A proof would be nice. More detailed one than "cannot occur", that is. Condition in question is basically mq_treesize < 0 or total_size + mq_treesize (in natural numbers) > 2^BITS_PER_LONG. Now, the maximal values of ->mq_maxmsg and ->mq_msgsize are 2^16 and 2^24 resp. and we are guaranteed that their product is below 2^BITS_PER_LONG. For mq_treesize we are guaranteed that it's below 2^31. Now, on a 64bit box that would suffice to avoid overflow - the product is at most 2^40 and its sum with mq_treesize can't wrap around. For 32bit system, though... Suppose attr->mq_maxmsg == 65535 and attr->mq_msgsize == 65537. Their product *is* below 2^BITS_PER_LONG - it's exactly 1 less than that. _Any_ non-zero value for mq_tresize (and it will be non-zero in the above) will lead to wraparound. Looks like a counterexample to your assertion above... -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/