From: "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> To: Andrew Morton <akpm@linux-foundation.org> Cc: mtk.manpages@gmail.com, Willy Tarreau <w@1wt.eu>, Vegard Nossum <vegard.nossum@oracle.com>, socketpair@gmail.com, Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>, Jens Axboe <axboe@fb.com>, Al Viro <viro@zeniv.linux.org.uk>, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 6/8] pipe: fix limit checking in alloc_pipe_info() Date: Fri, 19 Aug 2016 17:25:48 +1200 [thread overview] Message-ID: <e6a5a6dc-83eb-ecab-98ea-7a86c326dc36@gmail.com> (raw) In-Reply-To: <67ce15aa-cf43-0c89-d079-2d966177c56d@gmail.com> The limit checking in alloc_pipe_info() (used by pipe(2) and when opening a FIFO) has the following problems: (1) When checking capacity required for the new pipe, the checks against the limit in /proc/sys/fs/pipe-user-pages-{soft,hard} are made against existing consumption, and exclude the memory required for the new pipe capacity. As a consequence: (1) the memory allocation throttling provided by the soft limit does not kick in quite as early as it should, and (2) the user can overrun the hard limit. (2) As currently implemented, accounting and checking against the limits is done as follows: (a) Test whether the user has exceeded the limit. (b) Make new pipe buffer allocation. (c) Account new allocation against the limits. This is racey. Multiple processes may pass point (a) simultaneously, and then allocate pipe buffers that are accounted for only in step (c). The race means that the user's pipe buffer allocation could be pushed over the limit (by an arbitrary amount, depending on how unlucky we were in the race). [Thanks to Vegard Nossum for spotting this point, which I had missed.] This patch addresses the above problems as follows: * Alter the checks against limits to include the memory required for the new pipe. * Re-order the accounting step so that it precedes the buffer allocation. If the accounting step determines that a limit has been reached, revert the accounting and cause the operation to fail. Cc: Willy Tarreau <w@1wt.eu> Cc: Vegard Nossum <vegard.nossum@oracle.com> Cc: socketpair@gmail.com Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: Jens Axboe <axboe@fb.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: linux-api@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com> --- fs/pipe.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/fs/pipe.c b/fs/pipe.c index 613c6b9..705d79f 100644 --- a/fs/pipe.c +++ b/fs/pipe.c @@ -632,24 +632,28 @@ struct pipe_inode_info *alloc_pipe_info(void) if (pipe == NULL) goto out_free_uid; - if (!too_many_pipe_buffers_hard(user)) { - if (too_many_pipe_buffers_soft(user)) - pipe_bufs = 1; - pipe->bufs = kcalloc(pipe_bufs, - sizeof(struct pipe_buffer), - GFP_KERNEL_ACCOUNT); - } + if (too_many_pipe_buffers_soft(user)) + pipe_bufs = 1; + + account_pipe_buffers(user, 0, pipe_bufs); + + if (too_many_pipe_buffers_hard(user)) + goto out_revert_acct; + + pipe->bufs = kcalloc(pipe_bufs, sizeof(struct pipe_buffer), + GFP_KERNEL_ACCOUNT); if (pipe->bufs) { init_waitqueue_head(&pipe->wait); pipe->r_counter = pipe->w_counter = 1; pipe->buffers = pipe_bufs; pipe->user = user; - account_pipe_buffers(user, 0, pipe_bufs); mutex_init(&pipe->mutex); return pipe; } +out_revert_acct: + account_pipe_buffers(user, pipe_bufs, 0); kfree(pipe); out_free_uid: free_uid(user); -- 2.5.5
WARNING: multiple messages have this Message-ID (diff)
From: "Michael Kerrisk (man-pages)" <mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> To: Andrew Morton <akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org> Cc: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org, Willy Tarreau <w@1wt.eu>, Vegard Nossum <vegard.nossum-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>, socketpair-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org, Tetsuo Handa <penguin-kernel-JPay3/Yim36HaxMnTkn67Xf5DAMn2ifp@public.gmane.org>, Jens Axboe <axboe-b10kYP2dOMg@public.gmane.org>, Al Viro <viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org>, linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Subject: [PATCH 6/8] pipe: fix limit checking in alloc_pipe_info() Date: Fri, 19 Aug 2016 17:25:48 +1200 [thread overview] Message-ID: <e6a5a6dc-83eb-ecab-98ea-7a86c326dc36@gmail.com> (raw) In-Reply-To: <67ce15aa-cf43-0c89-d079-2d966177c56d-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> The limit checking in alloc_pipe_info() (used by pipe(2) and when opening a FIFO) has the following problems: (1) When checking capacity required for the new pipe, the checks against the limit in /proc/sys/fs/pipe-user-pages-{soft,hard} are made against existing consumption, and exclude the memory required for the new pipe capacity. As a consequence: (1) the memory allocation throttling provided by the soft limit does not kick in quite as early as it should, and (2) the user can overrun the hard limit. (2) As currently implemented, accounting and checking against the limits is done as follows: (a) Test whether the user has exceeded the limit. (b) Make new pipe buffer allocation. (c) Account new allocation against the limits. This is racey. Multiple processes may pass point (a) simultaneously, and then allocate pipe buffers that are accounted for only in step (c). The race means that the user's pipe buffer allocation could be pushed over the limit (by an arbitrary amount, depending on how unlucky we were in the race). [Thanks to Vegard Nossum for spotting this point, which I had missed.] This patch addresses the above problems as follows: * Alter the checks against limits to include the memory required for the new pipe. * Re-order the accounting step so that it precedes the buffer allocation. If the accounting step determines that a limit has been reached, revert the accounting and cause the operation to fail. Cc: Willy Tarreau <w@1wt.eu> Cc: Vegard Nossum <vegard.nossum-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org> Cc: socketpair-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org Cc: Tetsuo Handa <penguin-kernel-JPay3/Yim36HaxMnTkn67Xf5DAMn2ifp@public.gmane.org> Cc: Jens Axboe <axboe-b10kYP2dOMg@public.gmane.org> Cc: Al Viro <viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org> Cc: linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Cc: linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Signed-off-by: Michael Kerrisk <mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> --- fs/pipe.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/fs/pipe.c b/fs/pipe.c index 613c6b9..705d79f 100644 --- a/fs/pipe.c +++ b/fs/pipe.c @@ -632,24 +632,28 @@ struct pipe_inode_info *alloc_pipe_info(void) if (pipe == NULL) goto out_free_uid; - if (!too_many_pipe_buffers_hard(user)) { - if (too_many_pipe_buffers_soft(user)) - pipe_bufs = 1; - pipe->bufs = kcalloc(pipe_bufs, - sizeof(struct pipe_buffer), - GFP_KERNEL_ACCOUNT); - } + if (too_many_pipe_buffers_soft(user)) + pipe_bufs = 1; + + account_pipe_buffers(user, 0, pipe_bufs); + + if (too_many_pipe_buffers_hard(user)) + goto out_revert_acct; + + pipe->bufs = kcalloc(pipe_bufs, sizeof(struct pipe_buffer), + GFP_KERNEL_ACCOUNT); if (pipe->bufs) { init_waitqueue_head(&pipe->wait); pipe->r_counter = pipe->w_counter = 1; pipe->buffers = pipe_bufs; pipe->user = user; - account_pipe_buffers(user, 0, pipe_bufs); mutex_init(&pipe->mutex); return pipe; } +out_revert_acct: + account_pipe_buffers(user, pipe_bufs, 0); kfree(pipe); out_free_uid: free_uid(user); -- 2.5.5
next prev parent reply other threads:[~2016-08-19 5:27 UTC|newest] Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top [not found] <67ce15aa-cf43-0c89-d079-2d966177c56d@gmail.com> 2016-08-19 5:25 ` [PATCH 1/8] pipe: relocate round_pipe_size() above pipe_set_size() Michael Kerrisk (man-pages) 2016-08-19 5:25 ` [PATCH 2/8] pipe: move limit checking logic into pipe_set_size() Michael Kerrisk (man-pages) 2016-08-19 5:25 ` Michael Kerrisk (man-pages) 2016-08-19 5:25 ` [PATCH 3/8] pipe: refactor argument for account_pipe_buffers() Michael Kerrisk (man-pages) 2016-08-19 5:25 ` [PATCH 4/8] pipe: fix limit checking in pipe_set_size() Michael Kerrisk (man-pages) 2016-08-19 5:48 ` Willy Tarreau 2016-08-19 5:48 ` Willy Tarreau 2016-08-19 20:51 ` Michael Kerrisk (man-pages) 2016-08-19 20:51 ` Michael Kerrisk (man-pages) 2016-08-21 21:15 ` Michael Kerrisk (man-pages) 2016-08-21 21:15 ` Michael Kerrisk (man-pages) 2016-08-21 21:35 ` Willy Tarreau 2016-08-22 19:37 ` Michael Kerrisk (man-pages) 2016-08-22 19:37 ` Michael Kerrisk (man-pages) 2016-08-19 8:30 ` Vegard Nossum 2016-08-19 8:30 ` Vegard Nossum 2016-08-19 20:56 ` Michael Kerrisk (man-pages) 2016-08-19 20:56 ` Michael Kerrisk (man-pages) 2016-08-19 23:17 ` Michael Kerrisk (man-pages) 2016-08-19 23:17 ` Michael Kerrisk (man-pages) 2016-08-21 10:33 ` Vegard Nossum 2016-08-21 10:33 ` Vegard Nossum 2016-08-21 21:14 ` Michael Kerrisk (man-pages) 2016-08-21 21:14 ` Michael Kerrisk (man-pages) 2016-08-19 5:25 ` [PATCH 5/8] pipe: simplify logic in alloc_pipe_info() Michael Kerrisk (man-pages) 2016-08-19 5:25 ` Michael Kerrisk (man-pages) [this message] 2016-08-19 5:25 ` [PATCH 6/8] pipe: fix limit checking " Michael Kerrisk (man-pages) 2016-08-19 5:25 ` [PATCH 7/8] pipe: make account_pipe_buffers() return a value, and use it Michael Kerrisk (man-pages) 2016-08-19 9:36 ` Vegard Nossum 2016-08-19 9:36 ` Vegard Nossum 2016-08-19 20:51 ` Michael Kerrisk (man-pages) 2016-08-19 5:26 ` [PATCH 8/8] pipe: cap initial pipe capacity according to pipe-max-size limit Michael Kerrisk (man-pages)
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=e6a5a6dc-83eb-ecab-98ea-7a86c326dc36@gmail.com \ --to=mtk.manpages@gmail.com \ --cc=akpm@linux-foundation.org \ --cc=axboe@fb.com \ --cc=linux-api@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=penguin-kernel@I-love.SAKURA.ne.jp \ --cc=socketpair@gmail.com \ --cc=vegard.nossum@oracle.com \ --cc=viro@zeniv.linux.org.uk \ --cc=w@1wt.eu \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.