* [PATCH] pipe: reject oversized pipe-max-size sysctl writes
@ 2026-10-20 15:28 Hungyu Lin
0 siblings, 0 replies; only message in thread
From: Hungyu Lin @ 2026-10-20 15:28 UTC (permalink / raw)
To: Alexander Viro, Christian Brauner
Cc: Jan Kara, Joel Granados, Luca Vizzarro, linux-fsdevel,
linux-kernel, Hungyu Lin
On 64-bit kernels, the unsigned long sysctl input is truncated before
round_pipe_size() checks it as an unsigned int. Writing 4294967296 to
pipe-max-size therefore succeeds and stores PAGE_SIZE.
Reject values above UINT_MAX before narrowing them, so the sysctl
handler returns EINVAL without changing the stored limit.
Fixes: 515c5046650d ("pipe: Pass argument of pipe_fcntl as int")
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
fs/pipe.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/pipe.c b/fs/pipe.c
index 4fa69192e6fb..5472a687ddbb 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1566,6 +1566,9 @@ static struct file_system_type pipe_fs_type = {
static ulong round_pipe_size_ul(ulong size)
{
+ if (size > UINT_MAX)
+ return 0;
+
return round_pipe_size(size);
}
base-commit: f47d223627f80cb7a1eb14c585fe6cb35de5e984
--
2.43.0
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-10-20 15:29 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-20 15:28 [PATCH] pipe: reject oversized pipe-max-size sysctl writes Hungyu Lin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®