Skip to content

Commit e97824f

Browse files
MiaoheLinebiederm
authored andcommitted
mm/mlock: fix two bugs in user_shm_lock()
user_shm_lock forgets to set allowed to 0 when get_ucounts fails. So the later user_shm_unlock might do the extra dec_rlimit_ucounts. Also in the RLIM_INFINITY case, user_shm_lock will success regardless of the value of memlock where memblock == LONG_MAX && !capable(CAP_IPC_LOCK) should fail. Fix all of these by changing the code to leave lock_limit at ULONG_MAX aka RLIM_INFINITY, leave "allowed" initialized to 0 and remove the special case of RLIM_INFINITY as nothing can be greater than ULONG_MAX. Credit goes to Eric W. Biederman for proposing simplifying the code and thus catching the later bug. Fixes: d7c9e99 ("Reimplement RLIMIT_MEMLOCK on top of ucounts") Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Cc: stable@vger.kernel.org v1: https://lkml.kernel.org/r/20220310132417.41189-1-linmiaohe@huawei.com v2: https://lkml.kernel.org/r/20220314064039.62972-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20220322080918.59861-1-linmiaohe@huawei.com Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
1 parent ffb217a commit e97824f

File tree

1 file changed

+3
-4
lines changed

1 file changed

+3
-4
lines changed

mm/mlock.c

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -827,13 +827,12 @@ int user_shm_lock(size_t size, struct ucounts *ucounts)
827827

828828
locked = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
829829
lock_limit = rlimit(RLIMIT_MEMLOCK);
830-
if (lock_limit == RLIM_INFINITY)
831-
allowed = 1;
832-
lock_limit >>= PAGE_SHIFT;
830+
if (lock_limit != RLIM_INFINITY)
831+
lock_limit >>= PAGE_SHIFT;
833832
spin_lock(&shmlock_user_lock);
834833
memlock = inc_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_MEMLOCK, locked);
835834

836-
if (!allowed && (memlock == LONG_MAX || memlock > lock_limit) && !capable(CAP_IPC_LOCK)) {
835+
if ((memlock == LONG_MAX || memlock > lock_limit) && !capable(CAP_IPC_LOCK)) {
837836
dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_MEMLOCK, locked);
838837
goto out;
839838
}

0 commit comments

Comments
 (0)