Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753430Ab0FHPOx (ORCPT ); Tue, 8 Jun 2010 11:14:53 -0400 Received: from fxip-0047f.externet.hu ([88.209.222.127]:48147 "EHLO pomaz-ex.szeredi.hu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752668Ab0FHPOw (ORCPT ); Tue, 8 Jun 2010 11:14:52 -0400 To: jens.axboe@oracle.com CC: akpm@linux-foundation.org, torvalds@linux-foundation.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org In-reply-to: (message from Miklos Szeredi on Tue, 08 Jun 2010 16:30:01 +0200) Subject: Re: [PATCH 2/2] pipe: remove bogus check from "set size" fcntl References: Message-Id: From: Miklos Szeredi Date: Tue, 08 Jun 2010 17:14:43 +0200 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1830 Lines: 60 On Tue, 08 Jun 2010, Miklos Szeredi wrote: > From: Miklos Szeredi > > As it stands this check compares the number of pages to the page size. > This makes no sense and makes the fcntl fail in almost any sane case. > > Fix it by removing the check completely, round_pipe_size() will make > sure that nr_pages >= 1 anyway. Hmm, not quite true. It can actually return zero if round_pipe_size() overflows unsigned int. Updated patch below. Thanks, Miklos ---- From: Miklos Szeredi Subject: pipe: fix check in "set size" fcntl As it stands this check compares the number of pages to the page size. This makes no sense and makes the fcntl fail in almost any sane case. Fix it by checking if nr_pages is not zero (it can become zero only if arg is too big and round_pipe_size() overflows). Signed-off-by: Miklos Szeredi --- fs/pipe.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) Index: linux-2.6/fs/pipe.c =================================================================== --- linux-2.6.orig/fs/pipe.c 2010-06-08 16:48:18.000000000 +0200 +++ linux-2.6/fs/pipe.c 2010-06-08 17:12:04.000000000 +0200 @@ -1215,12 +1215,13 @@ long pipe_fcntl(struct file *file, unsig size = round_pipe_size(arg); nr_pages = size >> PAGE_SHIFT; + ret = -EINVAL; + if (!nr_pages) + goto out; + if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) { ret = -EPERM; goto out; - } else if (nr_pages < PAGE_SIZE) { - ret = -EINVAL; - goto out; } ret = pipe_set_size(pipe, nr_pages); break; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/