]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
cgroup/rdma: fix integer overflow in rdmacg_try_charge()
authorcuitao <cuitao@kylinos.cn>
Tue, 14 Apr 2026 01:53:27 +0000 (09:53 +0800)
committerTejun Heo <tj@kernel.org>
Fri, 17 Apr 2026 17:25:27 +0000 (07:25 -1000)
commitc802f460dd485c1332b5a35e7adcfb2bc22536a2
tree48a4084420acda33564a9b3617e0f67f232b4eba
parenta5b98009f16d8a5fb4a8ff9a193f5735515c38fa
cgroup/rdma: fix integer overflow in rdmacg_try_charge()

The expression `rpool->resources[index].usage + 1` is computed in int
arithmetic before being assigned to s64 variable `new`. When usage equals
INT_MAX (the default "max" value), the addition overflows to INT_MIN.
This negative value then passes the `new > max` check incorrectly,
allowing a charge that should be rejected and corrupting usage to
negative.

Fix by casting usage to s64 before the addition so the arithmetic is
done in 64-bit.

Fixes: 39d3e7584a68 ("rdmacg: Added rdma cgroup controller")
Signed-off-by: cuitao <cuitao@kylinos.cn>
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
kernel/cgroup/rdma.c