pipe: set lower and upper limit on max pages in the pipe page array

We need at least two to guarantee proper POSIX behaviour, so
never allow a smaller limit than that.

Also expose a /proc/sys/fs/pipe-max-pages sysctl file that allows
root to define a sane upper limit. Make it default to 16 times the
default size, which is 16 pages.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

diff --git a/fs/pipe.c b/fs/pipe.c
index 054b8a6..d79872e 100644 (file)
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -19,11 +19,18 @@
 #include <linux/pagemap.h>
 #include <linux/audit.h>
 #include <linux/syscalls.h>
 #include <linux/pagemap.h>
 #include <linux/audit.h>
 #include <linux/syscalls.h>

+#include <linux/fcntl.h>

 
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
 
 /*
 
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
 
 /*

+ * The max size that a non-root user is allowed to grow the pipe. Can
+ * be set by root in /proc/sys/fs/pipe-max-pages
+ */
+unsigned int pipe_max_pages = PIPE_DEF_BUFFERS * 16;
+
+/*

  * We use a start+len construction, which provides full use of the 
  * allocated memory.
  * -- Florian Coosmann (FGC)
  * We use a start+len construction, which provides full use of the 
  * allocated memory.
  * -- Florian Coosmann (FGC)


@@ -1162,6 +1169,14 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
 
        switch (cmd) {
        case F_SETPIPE_SZ:
 
        switch (cmd) {
        case F_SETPIPE_SZ:

+               if (!capable(CAP_SYS_ADMIN) && arg > pipe_max_pages)
+                       return -EINVAL;
+               /*
+                * The pipe needs to be at least 2 pages large to
+                * guarantee POSIX behaviour.
+                */
+               if (arg < 2)
+                       return -EINVAL;

                ret = pipe_set_size(pipe, arg);
                break;
        case F_GETPIPE_SZ:
                ret = pipe_set_size(pipe, arg);
                break;
        case F_GETPIPE_SZ:

diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 65f4282..16de393 100644 (file)
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -139,6 +139,8 @@ void pipe_lock(struct pipe_inode_info *);
 void pipe_unlock(struct pipe_inode_info *);
 void pipe_double_lock(struct pipe_inode_info *, struct pipe_inode_info *);
 
 void pipe_unlock(struct pipe_inode_info *);
 void pipe_double_lock(struct pipe_inode_info *, struct pipe_inode_info *);
 

+extern unsigned int pipe_max_pages;
+

 /* Drop the inode semaphore and wait for a pipe event, atomically */
 void pipe_wait(struct pipe_inode_info *pipe);
 
 /* Drop the inode semaphore and wait for a pipe event, atomically */
 void pipe_wait(struct pipe_inode_info *pipe);
 

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 8686b0f..c649d1c 100644 (file)
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -52,6 +52,7 @@
 #include <linux/slow-work.h>
 #include <linux/perf_event.h>
 #include <linux/kprobes.h>
 #include <linux/slow-work.h>
 #include <linux/perf_event.h>
 #include <linux/kprobes.h>

+#include <linux/pipe_fs_i.h>

 
 #include <asm/uaccess.h>
 #include <asm/processor.h>
 
 #include <asm/uaccess.h>
 #include <asm/processor.h>


@@ -1423,6 +1424,14 @@ static struct ctl_table fs_table[] = {
                .child          = binfmt_misc_table,
        },
 #endif
                .child          = binfmt_misc_table,
        },
 #endif

+       {
+               .procname       = "pipe-max-pages",
+               .data           = &pipe_max_pages,
+               .maxlen         = sizeof(int),
+               .mode           = 0644,
+               .proc_handler   = &proc_dointvec_minmax,
+               .extra1         = &two,
+       },

 /*
  * NOTE: do not add new entries to this table unless you have read
  * Documentation/sysctl/ctl_unnumbered.txt
 /*
  * NOTE: do not add new entries to this table unless you have read
  * Documentation/sysctl/ctl_unnumbered.txt