Commit 80e0afe1 authored by Lukas Schauer's avatar Lukas Schauer Committed by Zizhi Wo
Browse files

pipe: wakeup wr_wait after setting max_usage 

stable inclusion
from stable-v5.10.210
commit 162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9EU
CVE: CVE-2023-52672

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8

--------------------------------

[ Upstream commit e95aada4cb93d42e25c30a0ef9eb2923d9711d4a ]

Commit c73be61c ("pipe: Add general notification queue support") a
regression was introduced that would lock up resized pipes under certain
conditions. See the reproducer in [1].

The commit resizing the pipe ring size was moved to a different
function, doing that moved the wakeup for pipe->wr_wait before actually
raising pipe->max_usage. If a pipe was full before the resize occured it
would result in the wakeup never actually triggering pipe_write.

Set @max_usage and @nr_accounted before waking writers if this isn't a
watch queue.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=212295 [1]
Link: https://lore.kernel.org/r/20231201-orchideen-modewelt-e009de4562c6@brauner


Fixes: c73be61c ("pipe: Add general notification queue support")
Reviewed-by: default avatarDavid Howells <dhowells@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarLukas Schauer <lukas@schauer.dev>
[Christian Brauner <brauner@kernel.org>: rewrite to account for watch queues]
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZizhi Wo <wozizhi@huawei.com>
parent ee7b127d

fs/pipe.c

+5 −2
Original line number Diff line number Diff line
@@ -1302,6 +1302,11 @@ int pipe_resize_ring(struct pipe_inode_info *pipe, unsigned int nr_slots) 
	pipe->tail = tail;

	pipe->head = head;



	if (!pipe_has_watch_queue(pipe)) {

		pipe->max_usage = nr_slots;

		pipe->nr_accounted = nr_slots;

	}



	spin_unlock_irq(&pipe->rd_wait.lock);



	/* This might have made more room for writers */
@@ -1353,8 +1358,6 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long arg) 
	if (ret < 0)

		goto out_revert_acct;



	pipe->max_usage = nr_slots;

	pipe->nr_accounted = nr_slots;

	return pipe->max_usage * PAGE_SIZE;



out_revert_acct: