[PATCH] pipe: reject oversized pipe-max-size sysctl writes

[Hungyu Lin <dennylin0707@gmail.com>]

On 64-bit kernels, the unsigned long sysctl input is truncated before
round_pipe_size() checks it as an unsigned int. Writing 4294967296 to
pipe-max-size therefore succeeds and stores PAGE_SIZE.

Reject values above UINT_MAX before narrowing them, so the sysctl
handler returns EINVAL without changing the stored limit.

Fixes: 515c5046650d ("pipe: Pass argument of pipe_fcntl as int")
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 fs/pipe.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/pipe.c b/fs/pipe.c
index 4fa69192e6fb..5472a687ddbb 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1566,6 +1566,9 @@ static struct file_system_type pipe_fs_type = {
 
 static ulong round_pipe_size_ul(ulong size)
 {
+	if (size > UINT_MAX)
+		return 0;
+
 	return round_pipe_size(size);
 }
 

base-commit: f47d223627f80cb7a1eb14c585fe6cb35de5e984
-- 
2.43.0