tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

cgroup/rdma: fix integer overflow in rdmacg_try_charge()

The expression `rpool->resources[index].usage + 1` is computed in int
arithmetic before being assigned to s64 variable `new`. When usage equals
INT_MAX (the default "max" value), the addition overflows to INT_MIN.
This negative value then passes the `new > max` check incorrectly,
allowing a charge that should be rejected and corrupting usage to
negative.

Fix by casting usage to s64 before the addition so the arithmetic is
done in 64-bit.

Fixes: 39d3e7584a68 ("rdmacg: Added rdma cgroup controller")
Signed-off-by: cuitao <cuitao@kylinos.cn>
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>

authored by

cuitao and committed by
Tejun Heo c802f460 a5b98009

+1 -1
+1 -1
kernel/cgroup/rdma.c
··· 283 283 ret = PTR_ERR(rpool); 284 284 goto err; 285 285 } else { 286 - new = rpool->resources[index].usage + 1; 286 + new = (s64)rpool->resources[index].usage + 1; 287 287 if (new > rpool->resources[index].max) { 288 288 ret = -EAGAIN; 289 289 goto err;