kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/fs
History
Willy Tarreau be65d29ff7 pipe: limit the per-user amount of pages allocated in pipes 
[ Upstream commit 759c01142a ]

On no-so-small systems, it is possible for a single process to cause an
OOM condition by filling large pipes with data that are never read. A
typical process filling 4000 pipes with 1 MB of data will use 4 GB of
memory. On small systems it may be tricky to set the pipe max size to
prevent this from happening.

This patch makes it possible to enforce a per-user soft limit above
which new pipes will be limited to a single page, effectively limiting
them to 4 kB each, as well as a hard limit above which no new pipes may
be created for this user. This has the effect of protecting the system
against memory abuse without hurting other users, and still allowing
pipes to work correctly though with less data at once.

The limit are controlled by two new sysctls : pipe-user-pages-soft, and
pipe-user-pages-hard. Both may be disabled by setting them to zero. The
default soft limit allows the default number of FDs per process (1024)
to create pipes of the default size (64kB), thus reaching a limit of 64MB
before starting to create only smaller pipes. With 256 processes limited
to 1024 FDs each, this results in 1024*64kB + (256*1024 - 1024) * 4kB =
1084 MB of memory allocated for a user. The hard limit is disabled by
default to avoid breaking existing applications that make intensive use
of pipes (eg: for splicing).

Reported-by: socketpair@gmail.com
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Mitigates: CVE-2013-4312 (Linux 2.0+)
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2016-07-12 08:48:19 -04:00
..
9p 9p: don't leave a half-initialized inode sitting around 2015-08-04 14:41:56 -04:00
adfs adfs: add __printf verification, fix format/argument mismatches 2014-08-08 15:57:24 -07:00
affs move d_rcu from overlapping d_child to overlapping d_alias 2014-12-16 09:39:06 -08:00
afs Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-10-13 16:23:15 +02:00
autofs4 autofs4 copy_dev_ioctl(): keep the value of ->size we'd used for allocation 2015-03-14 15:37:26 -04:00
befs fs/befs/btree.c: remove typedef befs_btree_node 2014-10-14 02:18:20 +02:00
bfs fs/bfs: use bfs prefix for dump_imap 2014-08-08 15:57:24 -07:00
btrfs Btrfs: don't use src fd for printk 2016-07-12 08:48:17 -04:00
cachefiles FS-Cache fixes 2014-10-14 08:40:15 +02:00
ceph ceph: fix message length computation 2016-01-21 11:23:29 -05:00
cifs File names with trailing period or space need special case conversion 2016-07-12 08:47:09 -04:00
coda move d_rcu from overlapping d_child to overlapping d_alias 2014-12-16 09:39:06 -08:00
configfs fs/configfs: use pr_fmt 2014-06-04 16:53:53 -07:00
cramfs fs/cramfs/inode.c: use linux/uaccess.h 2014-08-08 15:57:25 -07:00
debugfs debugfs: leave freeing a symlink body until inode eviction 2015-03-14 15:37:27 -04:00
devpts pty: make sure super_block is still valid in final /dev/tty close 2016-03-02 15:19:16 -05:00
dlm dlm: fix missing endian conversion of rcom_status flags 2014-10-14 15:11:48 -05:00
ecryptfs ecryptfs: forbid opening files without mmap handler 2016-06-19 23:47:47 -04:00
efivarfs efi: Make efivarfs entries immutable by default 2016-04-12 17:06:28 -04:00
efs fs/efs/namei.c: return is not a function 2014-08-08 15:57:18 -07:00
exofs Boaz Harrosh - Fix broken email address 2014-10-19 20:22:32 +03:00
exportfs move d_rcu from overlapping d_child to overlapping d_alias 2014-12-16 09:39:06 -08:00
ext2 percpu_counter: add @gfp to percpu_counter_init() 2014-09-08 09:51:29 +09:00
ext3 ext3: Don't check quota format when there are no quota files 2014-10-22 09:02:48 +02:00
ext4 ext4: fix NULL pointer dereference in ext4_mark_inode_dirty() 2016-07-12 08:47:56 -04:00
f2fs f2fs: fix possible data corruption in f2fs_write_begin() 2015-01-08 10:30:17 -08:00
fat fat: fix oops on corrupted vfat fs 2014-12-03 09:36:03 -08:00
freevxfs Major changes for 3.14 include support for the newly added ZERO_RANGE 2014-04-04 15:39:39 -07:00
fscache fs/fscache/object-list.c: use __seq_open_private() 2014-10-13 17:52:21 +01:00
fuse fuse: break infinite loop in fuse_fill_write_pages() 2016-04-12 09:09:42 -04:00
gfs2 GFS2: Fix crash during ACL deletion in acl max entry check in gfs2_set_acl() 2015-03-23 21:02:52 -04:00
hfs hfs,hfsplus: cache pages correctly between bnode_create and bnode_free 2015-10-07 10:23:45 -04:00
hfsplus hfs,hfsplus: cache pages correctly between bnode_create and bnode_free 2015-10-07 10:23:45 -04:00
hostfs uml: fix hostfs mknod() 2016-02-09 22:56:34 -05:00
hpfs hpfs: don't truncate the file when delete fails 2016-03-11 09:45:22 -05:00
hppfs clean up scary strncpy(dst, src, strlen(src)) uses 2013-07-03 16:07:41 -07:00
hugetlbfs fs/hugetlbfs/inode.c: remove null test before kfree 2014-06-04 16:54:11 -07:00
isofs get_rock_ridge_filename(): handle malformed NM entries 2016-05-17 21:48:14 -04:00
jbd fs, jbd: use a more generic hash function 2014-10-22 10:02:04 +02:00
jbd2 jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path 2016-04-18 08:49:27 -04:00
jffs2 Fix directory hardlinks from deleted directories 2016-03-11 09:45:19 -05:00
jfs Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-10-13 16:23:15 +02:00
kernfs vfs: Remove unnecessary calls of check_submounts_and_drop 2014-10-09 02:38:56 -04:00
lockd SUNRPC: NULL utsname dereference on NFS umount during namespace cleanup 2015-03-06 14:52:58 -08:00
logfs fs/logfs/readwrite.c: kernel-doc warning fixes 2014-08-06 18:01:12 -07:00
minix minix zmap block counts calculation fix 2014-08-08 15:57:20 -07:00
ncpfs ncpfs: return proper error from NCP_IOC_SETROOT ioctl 2015-01-08 10:30:28 -08:00
nfs NFS: Fix another OPEN_DOWNGRADE bug 2016-07-12 08:47:17 -04:00
nfs_common lockd: move lockd's grace period handling into its own module 2014-09-17 16:33:11 -04:00
nfsd nfsd4/rpc: move backchannel create logic into rpc code 2016-07-12 08:46:52 -04:00
nilfs2 fs/nilfs2: fix potential underflow in call to crc32_le 2016-07-12 08:47:13 -04:00
nls nls: have register_nls() set ->owner 2014-01-25 03:14:05 -05:00
notify fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() 2015-08-19 13:16:07 -04:00
ntfs NTFS: Bump version to 2.1.31. 2014-10-16 12:53:35 +01:00
ocfs2 ocfs2: fix posix_acl_create deadlock 2016-05-17 22:25:41 -04:00
omfs omfs: fix sign confusion for bitmap loop counter 2015-06-09 13:43:51 -04:00
openpromfs fs: push sync_filesystem() down to the file system's remount_fs() 2014-03-13 10:14:33 -04:00
overlayfs ovl: fix permission checking for setattr 2016-04-12 09:09:32 -04:00
proc proc: prevent accessing /proc/<PID>/environ until it's ready 2016-07-12 08:48:04 -04:00
pstore pstore-ram: Allow optional mapping with pgprot_noncached 2015-01-16 06:59:47 -08:00
qnx4 fs: push sync_filesystem() down to the file system's remount_fs() 2014-03-13 10:14:33 -04:00
qnx6 fs/qnx6: update debugging to current functions 2014-08-08 15:57:26 -07:00
quota quota: Fix possible GPF due to uninitialised pointers 2016-04-18 08:49:21 -04:00
ramfs fs/ramfs/file-nommu.c: replace count*size kzalloc by kcalloc 2014-08-08 15:57:18 -07:00
reiserfs reiserfs: destroy allocated commit workqueue 2015-01-16 06:59:53 -08:00
romfs fs/romfs/super.c: add blank line after declarations 2014-08-08 15:57:25 -07:00
squashfs fs/squashfs/super.c: logging cleanup 2014-08-06 18:01:13 -07:00
sysfs mnt: Refactor the logic for mounting sysfs and proc in a user namespace 2015-07-12 09:49:24 -04:00
sysv write_iter variants of {__,}generic_file_aio_write() 2014-05-06 17:38:00 -04:00
ubifs UBIFS: Implement ->migratepage() 2016-07-12 08:47:01 -04:00
udf udf: Check output buffer length when converting name to CS0 2016-02-09 22:56:19 -05:00
ufs fs/ufs: restore s_lock mutex_init() 2015-07-20 21:12:44 -04:00
xfs xfs: skip stale inodes in xfs_iflush_cluster 2016-06-06 19:11:08 -04:00
aio.c ioctx_alloc(): fix vma (and file) leak on failure 2015-04-24 17:14:06 -04:00
anon_inodes.c vfs: Allocate anon_inode_inode in anon_inode_init() 2014-03-27 09:52:54 -07:00
attr.c fs,userns: Change inode_capable to capable_wrt_inode_uidgid 2014-06-10 13:57:22 -07:00
bad_inode.c bad_inode: add ->rename2() 2014-08-07 14:40:09 -04:00
binfmt_aout.c handle suicide on late failure exits in execve() in search_binary_handler() 2014-10-09 02:39:00 -04:00
binfmt_elf.c fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings 2015-06-15 14:00:57 -04:00
binfmt_elf_fdpic.c handle suicide on late failure exits in execve() in search_binary_handler() 2014-10-09 02:39:00 -04:00
binfmt_em86.c file->f_op is never NULL... 2013-10-24 23:34:54 -04:00
binfmt_flat.c fs/binfmt_flat.c: make old_reloc() static 2014-06-04 16:54:21 -07:00
binfmt_misc.c binfmt_misc: work around gcc-4.9 warning 2014-10-14 02:18:16 +02:00
binfmt_script.c exec: do not leave bprm->interp on stack 2012-12-20 17:40:19 -08:00
binfmt_som.c get rid of pt_regs argument of ->load_binary() 2012-11-28 21:53:38 -05:00
block_dev.c Return short read or 0 at end of a raw device, not EIO 2014-10-31 06:33:26 -04:00
buffer.c fs: clarify rate limit suppressed buffer I/O errors 2014-10-21 13:55:11 -06:00
char_dev.c Merge branch 'for-3.13/core' of git://git.kernel.dk/linux-block 2013-11-14 12:08:14 +09:00
compat.c vfs: move getname() from callers to do_mount() 2014-10-09 02:39:16 -04:00
compat_binfmt_elf.c binfmt_elf: add ELF_HWCAP2 to compat auxv entries 2014-03-04 08:05:21 +00:00
compat_ioctl.c Bluetooth: Move HCI socket definitions into its own header file 2014-07-11 13:53:04 +03:00
coredump.c fs/coredump: prevent fsuid=0 dumps into user-controlled directories 2016-04-18 08:49:38 -04:00
dcache.c fix d_walk()/non-delayed __d_free() race 2016-06-19 23:47:45 -04:00
dcookies.c fs/compat: fix lookup_dcookie() parameter handling 2014-01-29 16:22:40 -08:00
direct-io.c fuse: honour max_read and max_write in direct_io mode 2014-09-26 21:16:51 -04:00
drop_caches.c fs: convert use of typedef ctl_table to struct ctl_table 2014-06-06 16:08:16 -07:00
eventfd.c eventfd_ctx_fdget(): use fdget() instead of fget() 2014-01-25 03:13:04 -05:00
eventpoll.c eventpoll: fix uninitialized variable in epoll_ctl 2014-09-10 15:42:12 -07:00
exec.c parisc,metag: Fix crashes due to stack randomization on stack-grows-upwards architectures 2015-06-10 13:42:33 -04:00
fcntl.c security: make security_file_set_fowner, f_setown and __f_setown void return 2014-09-09 16:01:36 -04:00
fhandle.c fs/coredump: prevent fsuid=0 dumps into user-controlled directories 2016-04-18 08:49:38 -04:00
file.c Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-10-13 15:44:12 +02:00
file_table.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2014-10-13 11:28:42 +02:00
filesystems.c sys_sysfs: Add CONFIG_SYSFS_SYSCALL 2014-04-03 16:21:05 -07:00
fs-writeback.c fs-writeback: unplug before cond_resched in writeback_sb_inodes 2016-03-04 10:19:42 -05:00
fs_pin.c fs_pin: Allow for the possibility that m_list or s_list go unused. 2015-06-09 13:43:44 -04:00
fs_struct.c seqcount: Add lockdep functionality to seqcount/seqlock structures 2013-11-06 12:40:26 +01:00
inode.c fs: Fix S_NOSEC handling 2015-07-13 08:50:03 -04:00
internal.h overlayfs: Make f_path always point to the overlay and f_inode to the underlay 2015-10-27 22:14:24 -04:00
ioctl.c file->f_op is never NULL... 2013-10-24 23:34:54 -04:00
Kconfig overlay filesystem 2014-10-24 00:14:38 +02:00
Kconfig.binfmt fs: make binfmt support for #! scripts modular and removable 2013-04-30 17:04:04 -07:00
libfs.c move d_rcu from overlapping d_child to overlapping d_alias 2014-12-16 09:39:06 -08:00
locks.c locks: use file_inode() 2016-07-12 08:47:18 -04:00
Makefile ovl: rename filesystem type to "overlay" 2014-11-20 16:39:59 +01:00
mbcache.c fs/mbcache: replace __builtin_log2() with ilog2() 2014-06-25 22:08:29 -04:00
mount.h vfs: Add a function to lazily unmount all mounts from any dentry. 2014-10-09 02:38:55 -04:00
mpage.c vfs: guard end of device for mpage interface 2014-10-09 22:25:53 -04:00
namei.c atomic_open(): fix the handling of create_error 2016-05-17 16:31:08 -04:00
namespace.c namespace: update event counter when umounting a deleted dentry 2016-07-12 08:47:18 -04:00
no-block.c llseek: automatically add .llseek fop 2010-10-15 15:53:27 +02:00
open.c fs/coredump: prevent fsuid=0 dumps into user-controlled directories 2016-04-18 08:49:38 -04:00
pipe.c pipe: limit the per-user amount of pages allocated in pipes 2016-07-12 08:48:19 -04:00
pnode.c propogate_mnt: Handle the first propogated copy being a slave 2016-05-17 17:41:47 -04:00
pnode.h mnt: Improve the umount_tree flags 2015-05-17 19:12:08 -04:00
posix_acl.c posix_acl: handle NULL ACL in posix_acl_equiv_mode 2014-05-06 13:58:42 -04:00
proc_namespace.c namespaces: Use task_lock and not rcu to protect nsproxy 2014-07-29 18:08:50 -07:00
read_write.c cachefiles_write_page(): switch to __kernel_write() 2014-10-09 02:39:05 -04:00
readdir.c fanotify: create FAN_ACCESS event for readdir 2014-06-04 16:53:52 -07:00
select.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-11-13 15:34:18 +09:00
seq_file.c fs/seq_file: fallback to vmalloc allocation 2014-07-03 09:21:54 -07:00
signalfd.c signalfd: fix information leak in signalfd_copyinfo 2015-08-27 13:25:36 -04:00
splice.c splice: handle zero nr_pages in splice_to_pipe() 2016-04-18 08:49:36 -04:00
stack.c fs: fix comment for 'CONFIG_LBADF' 2014-08-26 09:35:56 +02:00
stat.c vfs: split out vfs_getattr_nosec 2013-11-09 00:16:31 -05:00
statfs.c vfs: allow O_PATH file descriptors for fstatfs() 2013-10-12 13:12:31 -07:00
super.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2014-10-13 11:28:42 +02:00
sync.c Export sync_filesystem() for modular ->remount_fs() use 2014-09-05 08:16:21 -07:00
timerfd.c timerfd: Remove an always true check 2014-08-27 11:17:48 +02:00
utimes.c locks: break delegations on any attribute modification 2013-11-09 00:16:44 -05:00
xattr.c vfs: Deduplicate code shared by xattr system calls operating on paths 2014-10-12 17:09:10 -04:00