From: Andrew Morton <akpm@linux-foundation.org>
To: Takashi Iwai <tiwai@suse.de>
Cc: Davidlohr Bueso <dbueso@suse.de>,
linux-kernel@vger.kernel.org, Waiman Long <longman@redhat.com>
Subject: Re: [PATCH] ipc: Limit sysctl value to IPCMNI
Date: Mon, 11 Jun 2018 16:18:45 -0700 [thread overview]
Message-ID: <20180611161845.6164d3a6c2df353fe11895bf@linux-foundation.org> (raw)
In-Reply-To: <s5ha7s43167.wl-tiwai@suse.de>
On Sat, 09 Jun 2018 08:48:48 +0200 Takashi Iwai <tiwai@suse.de> wrote:
> On Fri, 08 Jun 2018 23:16:59 +0200,
> Andrew Morton wrote:
> >
> > On Fri, 8 Jun 2018 15:49:49 +0200 Takashi Iwai <tiwai@suse.de> wrote:
> >
> > > Currently shmmni proc entry accepts all entered integer values, but
> > > the practical limit is IPCMNI (32768). This confuses user as if a
> > > bigger value were accepted but not applied correctly.
> > >
> > > This patch changes the proc entry to use *_minmax variant to limit the
> > > accepted values accordingly.
> >
> > Waiman Long was working on a (vastly more complicated) patchset to
> > address this.
>
> That's great. Any patch available for testing?
I think
http://lkml.kernel.org/r/1520885744-1546-1-git-send-email-longman@redhat.com
is the most recent version.
>
> > > --- a/ipc/ipc_sysctl.c
> > > +++ b/ipc/ipc_sysctl.c
> > > @@ -99,6 +99,7 @@ static int proc_ipc_auto_msgmni(struct ctl_table *table, int write,
> > > static int zero;
> > > static int one = 1;
> > > static int int_max = INT_MAX;
> > > +static int ipcmni = IPCMNI;
> > >
> > > static struct ctl_table ipc_kern_table[] = {
> > > {
> > > @@ -120,7 +121,9 @@ static struct ctl_table ipc_kern_table[] = {
> > > .data = &init_ipc_ns.shm_ctlmni,
> > > .maxlen = sizeof(init_ipc_ns.shm_ctlmni),
> > > .mode = 0644,
> > > - .proc_handler = proc_ipc_dointvec,
> > > + .proc_handler = proc_ipc_dointvec_minmax,
> > > + .extra1 = &zero,
> > > + .extra2 = &ipcmni,
> > > },
> > > {
> > > .procname = "shm_rmid_forced",
> >
> > What is the back-compatibility situation here?
>
> It's obviously an error to set such a high value and suppose that it
> were accepted. So relying on that behavior must be broken in
> anyway...
Well the present behaviour is to convert higher values downwards, yes?
int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int limit)
{
kuid_t euid;
kgid_t egid;
int id, err;
if (limit > IPCMNI)
limit = IPCMNI;
So if someone out there is presently setting this to 999999 then their
kernel will work just fine. After your proposed change, it will no
longer do so - the tuning attempt will fail with -EINVAL.
It really does us no good to say "you shouldn't have been doing that".
The fact that they *are* doing it and that it works OK is the kernel
developers' fault for not applying suitable checking on day one. I
think we're stuck with continuing to accept such input.
next prev parent reply other threads:[~2018-06-11 23:18 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-08 13:49 [PATCH] ipc: Limit sysctl value to IPCMNI Takashi Iwai
2018-06-08 21:16 ` Andrew Morton
2018-06-09 6:48 ` Takashi Iwai
2018-06-11 23:18 ` Andrew Morton [this message]
2018-06-12 6:36 ` Takashi Iwai
2018-06-12 23:36 ` Andrew Morton
2018-06-18 5:27 ` Waiman Long
2018-06-18 21:51 ` Andrew Morton
2018-06-11 21:27 ` Waiman Long
2018-06-12 6:31 ` Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180611161845.6164d3a6c2df353fe11895bf@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=dbueso@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=longman@redhat.com \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).