linux-stable/kernel
Eric Sandeen 471c89b7d4 watch_queue: fix pipe accounting mismatch
[ Upstream commit f13abc1e8e ]

Currently, watch_queue_set_size() modifies the pipe buffers charged to
user->pipe_bufs without updating the pipe->nr_accounted on the pipe
itself, due to the if (!pipe_has_watch_queue()) test in
pipe_resize_ring(). This means that when the pipe is ultimately freed,
we decrement user->pipe_bufs by something other than what than we had
charged to it, potentially leading to an underflow. This in turn can
cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.

To remedy this, explicitly account for the pipe usage in
watch_queue_set_size() to match the number set via account_pipe_buffers()

(It's unclear why watch_queue_set_size() does not update nr_accounted;
it may be due to intentional overprovisioning in watch_queue_set_size()?)

Fixes: e95aada4cb ("pipe: wakeup wr_wait after setting max_usage")
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Link: https://lore.kernel.org/r/206682a8-0604-49e5-8224-fdbe0c12b460@redhat.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-04-10 14:31:57 +02:00
..
bpf bpf: skip non exist keys in generic_map_lookup_batch 2025-03-13 12:50:53 +01:00
cgroup cgroup: fix race between fork and cgroup.kill 2025-03-13 12:50:40 +01:00
configs
debug kdb: Do not assume write() callback available 2025-03-13 12:50:45 +01:00
dma memblock: drop memblock_free_early_nid() and memblock_free_early() 2025-03-13 12:50:07 +01:00
entry
events perf/core: Fix low freq setting via IOC_PERIOD 2025-03-13 12:50:59 +01:00
futex
gcov gcov: add support for GCC 14 2024-07-05 09:14:34 +02:00
irq genirq: Make handle_enforce_irqctx() unconditionally available 2025-03-13 12:49:52 +01:00
kcsan kcsan: Turn report_filterlist_lock into a raw_spinlock 2024-12-14 19:51:35 +01:00
livepatch
locking lockdep: fix deadlock issue between lockdep and rcu 2024-10-17 15:11:18 +02:00
power PM: hibernate: Add error handling for syscore_suspend() 2025-03-13 12:50:12 +01:00
printk printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX 2025-03-13 12:50:17 +01:00
rcu rcu-tasks: Idle tasks on offline CPUs are in quiescent states 2024-12-14 19:50:41 +01:00
sched sched: Clarify wake_up_q()'s write to task->wake_q.next 2025-04-10 14:31:50 +02:00
time hrtimers: Mark is_migration_base() with __always_inline 2025-04-10 14:31:50 +02:00
trace ftrace: Avoid potential division by zero in function_stat_show() 2025-03-13 12:50:58 +01:00
.gitignore
acct.c acct: block access to kernel internal filesystems 2025-03-13 12:50:54 +01:00
async.c
audit_fsnotify.c
audit_tree.c
audit_watch.c
audit.c
audit.h
auditfilter.c ima: Avoid blocking in RCU read-side critical section 2024-07-18 13:07:34 +02:00
auditsc.c
backtracetest.c
bounds.c
capability.c
cfi.c
compat.c
configs.c
context_tracking.c
cpu_pm.c
cpu.c hrtimers: Handle CPU state correctly on hotplug 2025-01-23 17:16:02 +01:00
crash_core.c
crash_dump.c
cred.c
delayacct.c
dma.c
exec_domain.c
exit.c mm: optimize the redundant loop of mm_update_owner_next() 2024-07-18 13:07:32 +02:00
extable.c
fail_function.c
fork.c posix-cpu-timers: Clear TICK_DEP_BIT_POSIX_TIMER on clone 2024-11-14 13:13:39 +01:00
freezer.c
gen_kheaders.sh kheaders: Ignore silly-rename files 2025-01-23 17:16:00 +01:00
groups.c
hung_task.c hung_task: move hung_task sysctl interface to hung_task.c 2025-03-13 12:49:50 +01:00
iomem.c
irq_work.c
jump_label.c
kallsyms.c
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c kcov: mark in_softirq_really() as __always_inline 2025-01-09 13:28:50 +01:00
kexec_core.c
kexec_elf.c
kexec_file.c
kexec_internal.h
kexec.c
kheaders.c
kmod.c
kprobes.c kprobes: Fix to check symbol prefixes correctly 2024-08-19 05:45:42 +02:00
ksysfs.c
kthread.c kthread: unpark only parked kthread 2024-10-17 15:12:00 +02:00
latencytop.c
Makefile
module_signature.c
module_signing.c
module-internal.h
module.c
notifier.c
nsproxy.c
padata.c padata: avoid UAF for reorder_work 2025-03-13 12:50:02 +01:00
panic.c
params.c
pid_namespace.c zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING 2024-07-05 09:14:24 +02:00
pid.c
profile.c profiling: remove profile=sleep support 2024-08-19 05:45:39 +02:00
ptrace.c
range.c
reboot.c
regset.c
relay.c
resource_kunit.c
resource.c resource: fix region_intersects() vs add_memory_driver_managed() 2024-10-17 15:11:59 +02:00
rseq.c
scftorture.c
scs.c
seccomp.c
signal.c signal: Replace BUG_ON()s 2024-10-17 15:11:27 +02:00
smp.c smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() 2024-09-12 11:07:49 +02:00
smpboot.c
smpboot.h
softirq.c
stackleak.c
stacktrace.c
static_call_inline.c x86/static-call: provide a way to do very early static-call updates 2024-12-19 18:07:22 +01:00
static_call.c
stop_machine.c
sys_ni.c syscalls: fix compat_sys_io_pgetevents_time64 usage 2024-07-05 09:14:50 +02:00
sys.c
sysctl-test.c
sysctl.c fs: move fs stat sysctls to file_table.c 2025-03-13 12:49:50 +01:00
task_work.c task_work: Introduce task_work_cancel() again 2024-08-19 05:45:13 +02:00
taskstats.c
test_kprobes.c
torture.c
tracepoint.c
tsacct.c
ucount.c ucounts: fix counter leak in inc_rlimit_get_ucounts() 2024-11-14 13:13:42 +01:00
uid16.c
uid16.h
umh.c
up.c
user_namespace.c
user-return-notifier.c
user.c
usermode_driver.c
utsname_sysctl.c
utsname.c
watch_queue.c watch_queue: fix pipe accounting mismatch 2025-04-10 14:31:57 +02:00
watchdog_hld.c watchdog/perf: properly initialize the turbo mode timestamp and rearm counter 2024-08-19 05:45:20 +02:00
watchdog.c
workqueue_internal.h
workqueue.c workqueue: Improve scalability of workqueue watchdog touch 2024-09-12 11:07:52 +02:00