releases/2.6.32.27/limit-sysctl_tcp_mem-and-sysctl_udp_mem-initializers-to-prevent-integer-overflows.patch

   1 From a599d3751b0eb60592e8ee8e020c8239dcd25264 Mon Sep 17 00:00:00 2001
   2 From: Robin Holt <holt@sgi.com>
   3 Date: Wed, 20 Oct 2010 02:03:37 +0000
   4 Subject: Limit sysctl_tcp_mem and sysctl_udp_mem initializers to prevent integer overflows.
   5
   6
   7 From: Robin Holt <holt@sgi.com>
   8
   9 [ Upstream fixed this in a different way as parts of the commits:
  10         8d987e5c7510 (net: avoid limits overflow)
  11         a9febbb4bd13 (sysctl: min/max bounds are optional)
  12         27b3d80a7b6a (sysctl: fix min/max handling in __do_proc_doulongvec_minmax())
  13  -DaveM ]
  14
  15 On a 16TB x86_64 machine, sysctl_tcp_mem[2], sysctl_udp_mem[2], and
  16 sysctl_sctp_mem[2] can integer overflow.  Set limit such that they are
  17 maximized without overflowing.
  18
  19 Signed-off-by: Robin Holt <holt@sgi.com>
  20 To: "David S. Miller" <davem@davemloft.net>
  21 Cc: Willy Tarreau <w@1wt.eu>
  22 Cc: linux-kernel@vger.kernel.org
  23 Cc: netdev@vger.kernel.org
  24 Cc: linux-sctp@vger.kernel.org
  25 Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
  26 Cc: "Pekka Savola (ipv6)" <pekkas@netcore.fi>
  27 Cc: James Morris <jmorris@namei.org>
  28 Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
  29 Cc: Patrick McHardy <kaber@trash.net>
  30 Cc: Vlad Yasevich <vladislav.yasevich@hp.com>
  31 Cc: Sridhar Samudrala <sri@us.ibm.com>
  32 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  33 ---
  34  net/ipv4/tcp.c      |    4 +++-
  35  net/ipv4/udp.c      |    4 +++-
  36  net/sctp/protocol.c |    4 +++-
  37  3 files changed, 9 insertions(+), 3 deletions(-)
  38
  39 --- a/net/ipv4/tcp.c
  40 +++ b/net/ipv4/tcp.c
  41 @@ -2940,12 +2940,14 @@ void __init tcp_init(void)
  42
  43         /* Set the pressure threshold to be a fraction of global memory that
  44          * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
  45 -        * memory, with a floor of 128 pages.
  46 +        * memory, with a floor of 128 pages, and a ceiling that prevents an
  47 +        * integer overflow.
  48          */
  49         nr_pages = totalram_pages - totalhigh_pages;
  50         limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
  51         limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
  52         limit = max(limit, 128UL);
  53 +       limit = min(limit, INT_MAX * 4UL / 3 / 2);
  54         sysctl_tcp_mem[0] = limit / 4 * 3;
  55         sysctl_tcp_mem[1] = limit;
  56         sysctl_tcp_mem[2] = sysctl_tcp_mem[0] * 2;
  57 --- a/net/ipv4/udp.c
  58 +++ b/net/ipv4/udp.c
  59 @@ -1832,12 +1832,14 @@ void __init udp_init(void)
  60         udp_table_init(&udp_table);
  61         /* Set the pressure threshold up by the same strategy of TCP. It is a
  62          * fraction of global memory that is up to 1/2 at 256 MB, decreasing
  63 -        * toward zero with the amount of memory, with a floor of 128 pages.
  64 +        * toward zero with the amount of memory, with a floor of 128 pages,
  65 +        * and a ceiling that prevents an integer overflow.
  66          */
  67         nr_pages = totalram_pages - totalhigh_pages;
  68         limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
  69         limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
  70         limit = max(limit, 128UL);
  71 +       limit = min(limit, INT_MAX * 4UL / 3 / 2);
  72         sysctl_udp_mem[0] = limit / 4 * 3;
  73         sysctl_udp_mem[1] = limit;
  74         sysctl_udp_mem[2] = sysctl_udp_mem[0] * 2;
  75 --- a/net/sctp/protocol.c
  76 +++ b/net/sctp/protocol.c
  77 @@ -1157,7 +1157,8 @@ SCTP_STATIC __init int sctp_init(void)
  78
  79         /* Set the pressure threshold to be a fraction of global memory that
  80          * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
  81 -        * memory, with a floor of 128 pages.
  82 +        * memory, with a floor of 128 pages, and a ceiling that prevents an
  83 +        * integer overflow.
  84          * Note this initalizes the data in sctpv6_prot too
  85          * Unabashedly stolen from tcp_init
  86          */
  87 @@ -1165,6 +1166,7 @@ SCTP_STATIC __init int sctp_init(void)
  88         limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
  89         limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
  90         limit = max(limit, 128UL);
  91 +       limit = min(limit, INT_MAX * 4UL / 3 / 2);
  92         sysctl_sctp_mem[0] = limit / 4 * 3;
  93         sysctl_sctp_mem[1] = limit;
  94         sysctl_sctp_mem[2] = sysctl_sctp_mem[0] * 2;