• Michael Kerrisk (man-pages)'s avatar
    pipe: fix limit checking in alloc_pipe_info() · a005ca0e
    Michael Kerrisk (man-pages) authored
    The limit checking in alloc_pipe_info() (used by pipe(2) and when
    opening a FIFO) has the following problems:
    
    (1) When checking capacity required for the new pipe, the checks against
        the limit in /proc/sys/fs/pipe-user-pages-{soft,hard} are made
        against existing consumption, and exclude the memory required for
        the new pipe capacity. As a consequence: (1) the memory allocation
        throttling provided by the soft limit does not kick in quite as
        early as it should, and (2) the user can overrun the hard limit.
    
    (2) As currently implemented, accounting and checking against the limits
        is done as follows:
    
        (a) Test whether the user has exceeded the limit.
        (b) Make new pipe buffer allocation.
        (c) Account new allocation against the limits.
    
        This is racey. Multiple processes may pass point (a) simultaneously,
        and then allocate pipe buffers that are accounted for only in step
        (c).  The race means that the user's pipe buffer allocation could be
        pushed over the limit (by an arbitrary amount, depending on how
        unlucky we were in the race). [Thanks to Vegard Nossum for spotting
        this point, which I had missed.]
    
    This patch addresses the above problems as follows:
    
    * Alter the checks against limits to include the memory required for the
      new pipe.
    * Re-order the accounting step so that it precedes the buffer allocation.
      If the accounting step determines that a limit has been reached, revert
      the accounting and cause the operation to fail.
    
    Link: http://lkml.kernel.org/r/8ff3e9f9-23f6-510c-644f-8e70cd1c0bd9@gmail.comSigned-off-by: default avatarMichael Kerrisk <mtk.manpages@gmail.com>
    Reviewed-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
    Cc: Willy Tarreau <w@1wt.eu>
    Cc: <socketpair@gmail.com>
    Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Cc: Jens Axboe <axboe@fb.com>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    a005ca0e
pipe.c 27.1 KB