Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1242225 > unrolled thread

[PATCH 29/44] kdbus: Improve tests on incrementing quota

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH 29/44] kdbus: Improve tests on incrementing quota Sergei Zviagintsev <sergei@s15v.net> - 2015-10-08 13:40 +0200

#1242225 — [PATCH 29/44] kdbus: Improve tests on incrementing quota

 - Rewrite

       quota->memory + memory > U32_MAX

   as

       U32_MAX - quota->memory < memory

   There is no overflow issue in the original expression on 32-bit
   because the previous one (available - quota->memory < memory)
   guarantees that quota->memory + memory doesn't exceed `available'
   which is <= U32_MAX in that case. But lets replace it with less
   ambiguous variant.

 - Replace

       quota->fds + fds < quota->fds ||
       quota->fds + fds > KDBUS_CONN_MAX_FDS_PER_USER

   with

       quota->fds > KDBUS_CONN_MAX_FDS_PER_USER ||
       KDBUS_CONN_MAX_FDS_PER_USER - quota->fds < fds

   Reading the code, one can assume that the first original expression
   is there to ensure that quota->fds won't overflow after
   quota->fds += fds, but what it really does is testing for
   size_t overflow in `quota->fds + fds' to be safe in the second
   expression (as fds is size_t, quota->fds is converted to bigger
   type).

   Rewrite it in more obvious way. KDBUS_CONN_MAX_FDS_PER_USER is
   checked at compile time to fill in quota->fds type (there is
   BUILD_BUG_ON), so no further checks for quota->fds overflow are
   needed.

Signed-off-by: Sergei Zviagintsev <sergei@s15v.net>
---
 ipc/kdbus/connection.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ipc/kdbus/connection.c b/ipc/kdbus/connection.c
index c57ff2c846ee..b32b4f981618 100644
--- a/ipc/kdbus/connection.c
+++ b/ipc/kdbus/connection.c
@@ -717,12 +717,12 @@ int kdbus_conn_quota_inc(struct kdbus_conn *c, struct kdbus_user *u,
 
 	if (available < quota->memory ||
 	    available - quota->memory < memory ||
-	    quota->memory + memory > U32_MAX)
+	    U32_MAX - quota->memory < memory)
 		return -ENOBUFS;
 	if (quota->msgs >= KDBUS_CONN_MAX_MSGS)
 		return -ENOBUFS;
-	if (quota->fds + fds < quota->fds ||
-	    quota->fds + fds > KDBUS_CONN_MAX_FDS_PER_USER)
+	if (quota->fds > KDBUS_CONN_MAX_FDS_PER_USER ||
+	    KDBUS_CONN_MAX_FDS_PER_USER - quota->fds < fds)
 		return -EMFILE;
 
 	quota->memory += memory;
-- 
1.8.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [standalone]

Back to top | Article view | linux.kernel

csiph-web