summaryrefslogtreecommitdiffstats
path: root/ipc
diff options
context:
space:
mode:
authorDoug Ledford <dledford@redhat.com>2012-05-31 16:26:36 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2012-05-31 17:49:31 -0700
commit2c12ea498f349207c28840c0ed9654321aab7720 (patch)
treeef0f938e66a8a8b038e5c6be29e7f27294023c7e /ipc
parentd6629859b36d953a4b1369b749f178736911bf10 (diff)
downloadlinux-2c12ea498f349207c28840c0ed9654321aab7720.tar.gz
linux-2c12ea498f349207c28840c0ed9654321aab7720.tar.bz2
linux-2c12ea498f349207c28840c0ed9654321aab7720.zip
ipc/mqueue: correct mq_attr_ok test
While working on the other parts of the mqueue stuff, I noticed that the calculation for overflow in mq_attr_ok didn't actually match reality (this is especially true since my last patch which changed how we account memory slightly). In particular, we used to test for overflow using: msgs * msgsize + msgs * sizeof(struct msg_msg *) That was never really correct because each message we allocate via load_msg() is actually a struct msg_msg followed by the data for the message (and if struct msg_msg + data exceeds PAGE_SIZE we end up allocating struct msg_msgseg structs too, but accounting for them would get really tedious, so let's ignore those...they're only a pointer in size anyway). This patch updates the calculation to be more accurate in regards to maximum possible memory consumption by the mqueue. [akpm@linux-foundation.org: add a local to simplify overflow-checking expression] Signed-off-by: Doug Ledford <dledford@redhat.com> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Cc: Manfred Spraul <manfred@colorfullife.com> Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'ipc')
-rw-r--r--ipc/mqueue.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 3c72a05dc326..076399ce363a 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -676,6 +676,9 @@ static void remove_notification(struct mqueue_inode_info *info)
static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr)
{
+ int mq_treesize;
+ unsigned long total_size;
+
if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0)
return 0;
if (capable(CAP_SYS_RESOURCE)) {
@@ -690,9 +693,11 @@ static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr)
/* check for overflow */
if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg)
return 0;
- if ((unsigned long)(attr->mq_maxmsg * (attr->mq_msgsize
- + sizeof (struct msg_msg *))) <
- (unsigned long)(attr->mq_maxmsg * attr->mq_msgsize))
+ mq_treesize = attr->mq_maxmsg * sizeof(struct msg_msg) +
+ min_t(unsigned int, attr->mq_maxmsg, MQ_PRIO_MAX) *
+ sizeof(struct posix_msg_tree_node);
+ total_size = attr->mq_maxmsg * attr->mq_msgsize;
+ if (total_size + mq_treesize < total_size)
return 0;
return 1;
}