The variable 'new_usage' in misc_cg_try_charge() may overflow if it becomes above INT_MAX. This was observed when I implement the new SGX EPC cgroup[1] as a misc cgroup and test on a platform with large SGX EPC sizes. Change type of new_usage to long from int and check overflow. Fixes: a72232eabdfc ("cgroup: Add misc cgroup controller") Signed-off-by: Haitao Huang <haitao.huang@xxxxxxxxxxxxxxx> [1] https://lore.kernel.org/linux-sgx/20230712230202.47929-1-haitao.huang@xxxxxxxxxxxxxxx/ --- kernel/cgroup/misc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/cgroup/misc.c b/kernel/cgroup/misc.c index fe3e8a0eb7ed..b127607837c6 100644 --- a/kernel/cgroup/misc.c +++ b/kernel/cgroup/misc.c @@ -143,7 +143,7 @@ int misc_cg_try_charge(enum misc_res_type type, struct misc_cg *cg, struct misc_cg *i, *j; int ret; struct misc_res *res; - int new_usage; + long new_usage; if (!(valid_type(type) && cg && READ_ONCE(misc_res_capacity[type]))) return -EINVAL; @@ -156,7 +156,8 @@ int misc_cg_try_charge(enum misc_res_type type, struct misc_cg *cg, new_usage = atomic_long_add_return(amount, &res->usage); if (new_usage > READ_ONCE(res->max) || - new_usage > READ_ONCE(misc_res_capacity[type])) { + new_usage > READ_ONCE(misc_res_capacity[type]) || + new_usage < 0) { ret = -EBUSY; goto err_charge; } -- 2.25.1