summaryrefslogtreecommitdiff
path: root/kernel/trace
diff options
context:
space:
mode:
authorMatthew Wilcox <willy@infradead.org>2019-04-05 14:02:10 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2019-04-14 10:00:04 -0700
commit15fab63e1e57be9fdb5eec1bbc5916e9825e9acb (patch)
tree1353971310401012cf4b108a375e525065d8bec0 /kernel/trace
parent8fde12ca79aff9b5ba951fce1a2641901b8d8e64 (diff)
fs: prevent page refcount overflow in pipe_buf_get
Change pipe_buf_get() to return a bool indicating whether it succeeded in raising the refcount of the page (if the thing in the pipe is a page). This removes another mechanism for overflowing the page refcount. All callers converted to handle a failure. Reported-by: Jann Horn <jannh@google.com> Signed-off-by: Matthew Wilcox <willy@infradead.org> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel/trace')
-rw-r--r--kernel/trace/trace.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c4238b441624..0f300d488c9f 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6835,12 +6835,16 @@ static void buffer_pipe_buf_release(struct pipe_inode_info *pipe,
buf->private = 0;
}
-static void buffer_pipe_buf_get(struct pipe_inode_info *pipe,
+static bool buffer_pipe_buf_get(struct pipe_inode_info *pipe,
struct pipe_buffer *buf)
{
struct buffer_ref *ref = (struct buffer_ref *)buf->private;
+ if (ref->ref > INT_MAX/2)
+ return false;
+
ref->ref++;
+ return true;
}
/* Pipe buffer operations for a buffer. */