The patch titled Subject: ipc/mqueue: correct mq_attr_ok test has been removed from the -mm tree. Its filename was ipc-mqueue-correct-mq_attr_ok-test.patch This patch was dropped because it was merged into mainline or a subsystem tree The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ From: Doug Ledford <dledford@xxxxxxxxxx> Subject: ipc/mqueue: correct mq_attr_ok test While working on the other parts of the mqueue stuff, I noticed that the calculation for overflow in mq_attr_ok didn't actually match reality (this is especially true since my last patch which changed how we account memory slightly). In particular, we used to test for overflow using: msgs * msgsize + msgs * sizeof(struct msg_msg *) That was never really correct because each message we allocate via load_msg() is actually a struct msg_msg followed by the data for the message (and if struct msg_msg + data exceeds PAGE_SIZE we end up allocating struct msg_msgseg structs too, but accounting for them would get really tedious, so let's ignore those...they're only a pointer in size anyway). This patch updates the calculation to be more accurate in regards to maximum possible memory consumption by the mqueue. [akpm@xxxxxxxxxxxxxxxxxxxx: add a local to simplify overflow-checking expression] Signed-off-by: Doug Ledford <dledford@xxxxxxxxxx> Cc: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx> Cc: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx> Acked-by: KOSAKI Motohiro <kosaki.motohiro@xxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- ipc/mqueue.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff -puN ipc/mqueue.c~ipc-mqueue-correct-mq_attr_ok-test ipc/mqueue.c --- a/ipc/mqueue.c~ipc-mqueue-correct-mq_attr_ok-test +++ a/ipc/mqueue.c @@ -676,6 +676,9 @@ static void remove_notification(struct m static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr) { + int mq_treesize; + unsigned long total_size; + if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0) return 0; if (capable(CAP_SYS_RESOURCE)) { @@ -690,9 +693,11 @@ static int mq_attr_ok(struct ipc_namespa /* check for overflow */ if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg) return 0; - if ((unsigned long)(attr->mq_maxmsg * (attr->mq_msgsize - + sizeof (struct msg_msg *))) < - (unsigned long)(attr->mq_maxmsg * attr->mq_msgsize)) + mq_treesize = attr->mq_maxmsg * sizeof(struct msg_msg) + + min_t(unsigned int, attr->mq_maxmsg, MQ_PRIO_MAX) * + sizeof(struct posix_msg_tree_node); + total_size = attr->mq_maxmsg * attr->mq_msgsize; + if (total_size + mq_treesize < total_size) return 0; return 1; } _ Patches currently in -mm which might be from dledford@xxxxxxxxxx are origin.patch ipc-mqueue-strengthen-checks-on-mqueue-creation.patch tools-selftests-add-mq_perf_tests.patch ipc-mqueue-add-rbtree-node-caching-support.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html