From 135743d56ee7b7e7277b51ffb97bd6e9af0be150 Mon Sep 17 00:00:00 2001 From: Paul Gortmaker Date: Wed, 4 Jul 2018 13:28:48 -0400 Subject: pipe: no proc_douintvec_minmax in 4.12.x Signed-off-by: Paul Gortmaker --- ...match-pipe_max_size-data-type-with-procfs.patch | 108 --------------------- queue/series | 1 - 2 files changed, 109 deletions(-) delete mode 100644 queue/pipe-match-pipe_max_size-data-type-with-procfs.patch diff --git a/queue/pipe-match-pipe_max_size-data-type-with-procfs.patch b/queue/pipe-match-pipe_max_size-data-type-with-procfs.patch deleted file mode 100644 index 3498dd4..0000000 --- a/queue/pipe-match-pipe_max_size-data-type-with-procfs.patch +++ /dev/null @@ -1,108 +0,0 @@ -From 98159d977f71c3b3dee898d1c34e56f520b094e7 Mon Sep 17 00:00:00 2001 -From: Joe Lawrence -Date: Fri, 17 Nov 2017 15:29:17 -0800 -Subject: [PATCH] pipe: match pipe_max_size data type with procfs - -commit 98159d977f71c3b3dee898d1c34e56f520b094e7 upstream. - -Patch series "A few round_pipe_size() and pipe-max-size fixups", v3. - -While backporting Michael's "pipe: fix limit handling" patchset to a -distro-kernel, Mikulas noticed that current upstream pipe limit handling -contains a few problems: - - 1 - procfs signed wrap: echo'ing a large number into - /proc/sys/fs/pipe-max-size and then cat'ing it back out shows a - negative value. - - 2 - round_pipe_size() nr_pages overflow on 32bit: this would - subsequently try roundup_pow_of_two(0), which is undefined. - - 3 - visible non-rounded pipe-max-size value: there is no mutual - exclusion or protection between the time pipe_max_size is assigned - a raw value from proc_dointvec_minmax() and when it is rounded. - - 4 - unsigned long -> unsigned int conversion makes for potential odd - return errors from do_proc_douintvec_minmax_conv() and - do_proc_dopipe_max_size_conv(). - -This version underwent the same testing as v1: -https://marc.info/?l=linux-kernel&m=150643571406022&w=2 - -This patch (of 4): - -pipe_max_size is defined as an unsigned int: - - unsigned int pipe_max_size = 1048576; - -but its procfs/sysctl representation is an integer: - - static struct ctl_table fs_table[] = { - ... - { - .procname = "pipe-max-size", - .data = &pipe_max_size, - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = &pipe_proc_fn, - .extra1 = &pipe_min_size, - }, - ... - -that is signed: - - int pipe_proc_fn(struct ctl_table *table, int write, void __user *buf, - size_t *lenp, loff_t *ppos) - { - ... - ret = proc_dointvec_minmax(table, write, buf, lenp, ppos) - -This leads to signed results via procfs for large values of pipe_max_size: - - % echo 2147483647 >/proc/sys/fs/pipe-max-size - % cat /proc/sys/fs/pipe-max-size - -2147483648 - -Use unsigned operations on this variable to avoid such negative values. - -Link: http://lkml.kernel.org/r/1507658689-11669-2-git-send-email-joe.lawrence@redhat.com -Signed-off-by: Joe Lawrence -Reported-by: Mikulas Patocka -Reviewed-by: Mikulas Patocka -Cc: Michael Kerrisk -Cc: Randy Dunlap -Cc: Al Viro -Cc: Jens Axboe -Cc: Josh Poimboeuf -Signed-off-by: Andrew Morton -Signed-off-by: Linus Torvalds - -diff --git a/fs/pipe.c b/fs/pipe.c -index 349c9d56d4b3..3909c55ed389 100644 ---- a/fs/pipe.c -+++ b/fs/pipe.c -@@ -1125,7 +1125,7 @@ int pipe_proc_fn(struct ctl_table *table, int write, void __user *buf, - { - int ret; - -- ret = proc_dointvec_minmax(table, write, buf, lenp, ppos); -+ ret = proc_douintvec_minmax(table, write, buf, lenp, ppos); - if (ret < 0 || !write) - return ret; - -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index 4a13a389e99b..2d42183b4c98 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -1816,7 +1816,7 @@ static struct ctl_table fs_table[] = { - { - .procname = "pipe-max-size", - .data = &pipe_max_size, -- .maxlen = sizeof(int), -+ .maxlen = sizeof(pipe_max_size), - .mode = 0644, - .proc_handler = &pipe_proc_fn, - .extra1 = &pipe_min_size, --- -2.15.0 - diff --git a/queue/series b/queue/series index c6a54a5..9ebca60 100644 --- a/queue/series +++ b/queue/series @@ -71,7 +71,6 @@ gre6-use-log_ecn_error-module-parameter-in-ip6_tnl_r.patch route-also-update-fnhe_genid-when-updating-a-route-c.patch route-update-fnhe_expires-for-redirect-when-the-fnhe.patch drivers-rapidio-devices-rio_mport_cdev.c-fix-resourc.patch -pipe-match-pipe_max_size-data-type-with-procfs.patch lib-genalloc.c-make-the-avail-variable-an-atomic_lon.patch dynamic-debug-howto-fix-optional-omitted-ending-line.patch NFS-Fix-a-typo-in-nfs_rename.patch -- cgit 1.2.3-korg