Limit sysctl_tcp_mem and sysctl_udp_mem initializers to prevent integer overflows.

On a 16TB x86_64 machine, sysctl_tcp_mem[2], sysctl_udp_mem[2], and
sysctl_sctp_mem[2] can integer overflow.  Set limit such that they are
maximized without overflowing.

Signed-off-by: Robin Holt <holt@sgi.com>
To: "David S. Miller" <davem@davemloft.net>
Cc: Willy Tarreau <w@1wt.eu>
Cc: linux-kernel@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-sctp@vger.kernel.org
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: "Pekka Savola (ipv6)" <pekkas@netcore.fi>
Cc: James Morris <jmorris@namei.org>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: Patrick McHardy <kaber@trash.net>
Cc: Vlad Yasevich <vladislav.yasevich@hp.com>
Cc: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index c88ca260585dfd64ec871eeb8635fa7fc40ae64f..0e22467e040df72719a3a9be47c56a6422a07956 100644 (file)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3252,12 +3252,14 @@ void __init tcp_init(void)
 
        /* Set the pressure threshold to be a fraction of global memory that
         * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
-        * memory, with a floor of 128 pages.
+        * memory, with a floor of 128 pages, and a ceiling that prevents an
+        * integer overflow.
         */
        nr_pages = totalram_pages - totalhigh_pages;
        limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
        limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
        limit = max(limit, 128UL);
+       limit = min(limit, INT_MAX * 4UL / 3 / 2);
        sysctl_tcp_mem[0] = limit / 4 * 3;
        sysctl_tcp_mem[1] = limit;
        sysctl_tcp_mem[2] = sysctl_tcp_mem[0] * 2;

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 434dd6777419b51948a6fea97841bb1bbd210083..f0fbbba1d2039ae76c3ae7d5eafc90a908bfc52b 100644 (file)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2167,12 +2167,14 @@ void __init udp_init(void)
        udp_table_init(&udp_table, "UDP");
        /* Set the pressure threshold up by the same strategy of TCP. It is a
         * fraction of global memory that is up to 1/2 at 256 MB, decreasing
-        * toward zero with the amount of memory, with a floor of 128 pages.
+        * toward zero with the amount of memory, with a floor of 128 pages,
+        * and a ceiling that prevents an integer overflow.
         */
        nr_pages = totalram_pages - totalhigh_pages;
        limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
        limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
        limit = max(limit, 128UL);
+       limit = min(limit, INT_MAX * 4UL / 3 / 2);
        sysctl_udp_mem[0] = limit / 4 * 3;
        sysctl_udp_mem[1] = limit;
        sysctl_udp_mem[2] = sysctl_udp_mem[0] * 2;

diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 182749867c72a4c2b629d8675e1ad2de6340a536..b3d890fdf51b9c551d9253028b8c03120057145d 100644 (file)
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1161,7 +1161,8 @@ SCTP_STATIC __init int sctp_init(void)
 
        /* Set the pressure threshold to be a fraction of global memory that
         * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
-        * memory, with a floor of 128 pages.
+        * memory, with a floor of 128 pages, and a ceiling that prevents an
+        * integer overflow.
         * Note this initalizes the data in sctpv6_prot too
         * Unabashedly stolen from tcp_init
         */
@@ -1169,6 +1170,7 @@ SCTP_STATIC __init int sctp_init(void)
        limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
        limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
        limit = max(limit, 128UL);
+       limit = min(limit, INT_MAX * 4UL / 3 / 2);
        sysctl_sctp_mem[0] = limit / 4 * 3;
        sysctl_sctp_mem[1] = limit;
        sysctl_sctp_mem[2] = sysctl_sctp_mem[0] * 2;