From: Eric Biggers <ebiggers3@gmail.com>
To: linux-fsdevel@vger.kernel.org
Cc: Alexander Viro <viro@zeniv.linux.org.uk>,
        Joe Lawrence <joe.lawrence@redhat.com>,
        Michael Kerrisk <mtk.manpages@gmail.com>,
        Willy Tarreau <w@1wt.eu>,
        Mikulas Patocka <mpatocka@redhat.com>,
        "Luis R . Rodriguez" <mcgrof@kernel.org>,
        Kees Cook <keescook@chromium.org>,
        linux-kernel@vger.kernel.org, Eric Biggers <ebiggers@google.com>,
        stable@vger.kernel.org
Subject: [PATCH v2 4/7] pipe: fix off-by-one error when checking buffer limits
Date: Wed, 10 Jan 2018 21:28:59 -0800
Message-Id: <20180111052902.14409-5-ebiggers3@gmail.com>
In-Reply-To: <20180111052902.14409-1-ebiggers3@gmail.com>
References: <20180111052902.14409-1-ebiggers3@gmail.com>
Sender: linux-kernel-owner@vger.kernel.org

From: Eric Biggers <ebiggers@google.com>

With pipe-user-pages-hard set to 'N', users were actually only allowed
up to 'N - 1' buffers; and likewise for pipe-user-pages-soft.

Fix this to allow up to 'N' buffers, as would be expected.

Fixes: b0b91d18e2e9 ("pipe: fix limit checking in pipe_set_size()")
Cc: stable@vger.kernel.org
Acked-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Eric Biggers <ebiggers@google.com>
---
 fs/pipe.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/pipe.c b/fs/pipe.c
index 847ecc388820..9f20e7128578 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -605,12 +605,12 @@ static unsigned long account_pipe_buffers(struct user_struct *user,
 
 static bool too_many_pipe_buffers_soft(unsigned long user_bufs)
 {
-	return pipe_user_pages_soft && user_bufs >= pipe_user_pages_soft;
+	return pipe_user_pages_soft && user_bufs > pipe_user_pages_soft;
 }
 
 static bool too_many_pipe_buffers_hard(unsigned long user_bufs)
 {
-	return pipe_user_pages_hard && user_bufs >= pipe_user_pages_hard;
+	return pipe_user_pages_hard && user_bufs > pipe_user_pages_hard;
 }
 
 static bool is_unprivileged_user(void)
-- 
2.15.1