History

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull more vfs updates from Al Viro: "Embarrassing braino fix + pipe page accounting + fixing an eyesore in find_filesystem() (checking that s1 is equal to prefix of s2 of given length can be done in many ways, but "compare strlen(s1) with length and then do strncmp()" is not a good one...)" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: [regression] fix braino in fs/dlm/user.c pipe: limit the per-user amount of pages allocated in pipes find_filesystem(): simplify comparison

Linus Torvalds committed 10 years ago

Commit eadee0c2 parents 6fb11e6 117aa417 files · +91 −6Browse files

Unified · Split

7 files
  1. Documentation/sysctl/fs.txt +23 −0
  2. fs/dlm/user.c +1 −1
  3. fs/filesystems.c +3 −3
  4. fs/pipe.c +45 −2
  5. include/linux/pipe_fs_i.h +4 −0
  6. include/linux/sched.h +1 −0
  7. kernel/sysctl.c +14 −0
Documentation/sysctl/fs.txt+23−0
@@ -32,6 +32,8 @@ Currently, these files are in /proc/sys/fs: · 31 unmodified lines
3232 - nr_open
3333 - overflowuid
3434 - overflowgid
35+- pipe-user-pages-hard
36+- pipe-user-pages-soft
3537 - protected_hardlinks
3638 - protected_symlinks
3739 - suid_dumpable
@@ -159,6 +161,27 @@ The default is 65534. · 121 unmodified lines
159161
160162 ==============================================================
161163
164+pipe-user-pages-hard:
165+
166+Maximum total number of pages a non-privileged user may allocate for pipes.
167+Once this limit is reached, no new pipes may be allocated until usage goes
168+below the limit again. When set to 0, no limit is applied, which is the default
169+setting.
170+
171+==============================================================
172+
173+pipe-user-pages-soft:
174+
175+Maximum total number of pages a non-privileged user may allocate for pipes
176+before the pipe size gets limited to a single page. Once this limit is reached,
177+new pipes will be limited to a single page in size for this user in order to
178+limit total memory usage, and trying to increase them using fcntl() will be
179+denied until usage goes below the limit again. The default value allows to
180+allocate up to 1024 pipes at their default size. When set to 0, no limit is
181+applied.
182+
183+==============================================================
184+
162185 protected_hardlinks:
163186
164187 A long-standing class of security issues is the hardlink-based
fs/dlm/user.c+1−1
@@ -516,7 +516,7 @@ static ssize_t device_write(struct file *file, const char __user *buf, · 515 unmodified lines
516516 return -EINVAL;
517517
518518 kbuf = memdup_user_nul(buf, count);
519− if (!IS_ERR(kbuf))
519+ if (IS_ERR(kbuf))
520520 return PTR_ERR(kbuf);
521521
522522 if (check_version(kbuf)) {
fs/filesystems.c+3−3
@@ -46,9 +46,9 @@ void put_filesystem(struct file_system_type *fs) · 45 unmodified lines
4646 static struct file_system_type **find_filesystem(const char *name, unsigned len)
4747 {
4848 struct file_system_type **p;
49− for (p=&file_systems; *p; p=&(*p)->next)
50− if (strlen((*p)->name) == len &&
51− strncmp((*p)->name, name, len) == 0)
49+ for (p = &file_systems; *p; p = &(*p)->next)
50+ if (strncmp((*p)->name, name, len) == 0 &&
51+ !(*p)->name[len])
5252 break;
5353 return p;
5454 }
fs/pipe.c+45−2
@@ -38,6 +38,12 @@ unsigned int pipe_max_size = 1048576; · 37 unmodified lines
3838 */
3939 unsigned int pipe_min_size = PAGE_SIZE;
4040
41+/* Maximum allocatable pages per user. Hard limit is unset by default, soft
42+ * matches default values.
43+ */
44+unsigned long pipe_user_pages_hard;
45+unsigned long pipe_user_pages_soft = PIPE_DEF_BUFFERS * INR_OPEN_CUR;
46+
4147 /*
4248 * We use a start+len construction, which provides full use of the
4349 * allocated memory.
@@ -583,20 +589,49 @@ pipe_fasync(int fd, struct file *filp, int on) · 539 unmodified lines
583589 return retval;
584590 }
585591
592+static void account_pipe_buffers(struct pipe_inode_info *pipe,
593+ unsigned long old, unsigned long new)
594+{
595+ atomic_long_add(new - old, &pipe->user->pipe_bufs);
596+}
597+
598+static bool too_many_pipe_buffers_soft(struct user_struct *user)
599+{
600+ return pipe_user_pages_soft &&
601+ atomic_long_read(&user->pipe_bufs) >= pipe_user_pages_soft;
602+}
603+
604+static bool too_many_pipe_buffers_hard(struct user_struct *user)
605+{
606+ return pipe_user_pages_hard &&
607+ atomic_long_read(&user->pipe_bufs) >= pipe_user_pages_hard;
608+}
609+
586610 struct pipe_inode_info *alloc_pipe_info(void)
587611 {
588612 struct pipe_inode_info *pipe;
589613
590614 pipe = kzalloc(sizeof(struct pipe_inode_info), GFP_KERNEL);
591615 if (pipe) {
592− pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * PIPE_DEF_BUFFERS, GFP_KERNEL);
616+ unsigned long pipe_bufs = PIPE_DEF_BUFFERS;
617+ struct user_struct *user = get_current_user();
618+
619+ if (!too_many_pipe_buffers_hard(user)) {
620+ if (too_many_pipe_buffers_soft(user))
621+ pipe_bufs = 1;
622+ pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * pipe_bufs, GFP_KERNEL);
623+ }
624+
593625 if (pipe->bufs) {
594626 init_waitqueue_head(&pipe->wait);
595627 pipe->r_counter = pipe->w_counter = 1;
596− pipe->buffers = PIPE_DEF_BUFFERS;
628+ pipe->buffers = pipe_bufs;
629+ pipe->user = user;
630+ account_pipe_buffers(pipe, 0, pipe_bufs);
597631 mutex_init(&pipe->mutex);
598632 return pipe;
599633 }
634+ free_uid(user);
600635 kfree(pipe);
601636 }
602637
@@ -607,6 +642,8 @@ void free_pipe_info(struct pipe_inode_info *pipe) · 4 unmodified lines
607642 {
608643 int i;
609644
645+ account_pipe_buffers(pipe, pipe->buffers, 0);
646+ free_uid(pipe->user);
610647 for (i = 0; i < pipe->buffers; i++) {
611648 struct pipe_buffer *buf = pipe->bufs + i;
612649 if (buf->ops)
@@ -998,6 +1035,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages) · 385 unmodified lines
9981035 memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer));
9991036 }
10001037
1038+ account_pipe_buffers(pipe, pipe->buffers, nr_pages);
10011039 pipe->curbuf = 0;
10021040 kfree(pipe->bufs);
10031041 pipe->bufs = bufs;
@@ -1069,6 +1107,11 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg) · 65 unmodified lines
10691107 if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
10701108 ret = -EPERM;
10711109 goto out;
1110+ } else if ((too_many_pipe_buffers_hard(pipe->user) ||
1111+ too_many_pipe_buffers_soft(pipe->user)) &&
1112+ !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN)) {
1113+ ret = -EPERM;
1114+ goto out;
10721115 }
10731116 ret = pipe_set_size(pipe, nr_pages);
10741117 break;
include/linux/pipe_fs_i.h+4−0
@@ -42,6 +42,7 @@ struct pipe_buffer { · 41 unmodified lines
4242 * @fasync_readers: reader side fasync
4343 * @fasync_writers: writer side fasync
4444 * @bufs: the circular array of pipe buffers
45+ * @user: the user who created this pipe
4546 **/
4647 struct pipe_inode_info {
4748 struct mutex mutex;
@@ -57,6 +58,7 @@ struct pipe_inode_info { · 9 unmodified lines
5758 struct fasync_struct *fasync_readers;
5859 struct fasync_struct *fasync_writers;
5960 struct pipe_buffer *bufs;
61+ struct user_struct *user;
6062 };
6163
6264 /*
@@ -123,6 +125,8 @@ void pipe_unlock(struct pipe_inode_info *); · 60 unmodified lines
123125 void pipe_double_lock(struct pipe_inode_info *, struct pipe_inode_info *);
124126
125127 extern unsigned int pipe_max_size, pipe_min_size;
128+extern unsigned long pipe_user_pages_hard;
129+extern unsigned long pipe_user_pages_soft;
126130 int pipe_proc_fn(struct ctl_table *, int, void __user *, size_t *, loff_t *);
127131
128132
include/linux/sched.h+1−0
@@ -835,6 +835,7 @@ struct user_struct { · 834 unmodified lines
835835 #endif
836836 unsigned long locked_shm; /* How many pages of mlocked shm ? */
837837 unsigned long unix_inflight; /* How many files in flight in unix sockets */
838+ atomic_long_t pipe_bufs; /* how many pages are allocated in pipe buffers */
838839
839840 #ifdef CONFIG_KEYS
840841 struct key *uid_keyring; /* UID specific keyring */
kernel/sysctl.c+14−0
@@ -1757,6 +1757,20 @@ static struct ctl_table fs_table[] = { · 1756 unmodified lines
17571757 .proc_handler = &pipe_proc_fn,
17581758 .extra1 = &pipe_min_size,
17591759 },
1760+ {
1761+ .procname = "pipe-user-pages-hard",
1762+ .data = &pipe_user_pages_hard,
1763+ .maxlen = sizeof(pipe_user_pages_hard),
1764+ .mode = 0644,
1765+ .proc_handler = proc_doulongvec_minmax,
1766+ },
1767+ {
1768+ .procname = "pipe-user-pages-soft",
1769+ .data = &pipe_user_pages_soft,
1770+ .maxlen = sizeof(pipe_user_pages_soft),
1771+ .mode = 0644,
1772+ .proc_handler = proc_doulongvec_minmax,
1773+ },
17601774 { }
17611775 };
17621776