[PATCH 29/44] kdbus: Improve tests on incrementing quota

[Sergei Zviagintsev]

 - Rewrite

       quota->memory + memory > U32_MAX

   as

       U32_MAX - quota->memory < memory

   There is no overflow issue in the original expression on 32-bit
   because the previous one (available - quota->memory < memory)
   guarantees that quota->memory + memory doesn't exceed `available'
   which is <= U32_MAX in that case. But lets replace it with less
   ambiguous variant.

 - Replace

       quota->fds + fds < quota->fds ||
       quota->fds + fds > KDBUS_CONN_MAX_FDS_PER_USER

   with

       quota->fds > KDBUS_CONN_MAX_FDS_PER_USER ||
       KDBUS_CONN_MAX_FDS_PER_USER - quota->fds < fds

   Reading the code, one can assume that the first original expression
   is there to ensure that quota->fds won't overflow after
   quota->fds += fds, but what it really does is testing for
   size_t overflow in `quota->fds + fds' to be safe in the second
   expression (as fds is size_t, quota->fds is converted to bigger
   type).

   Rewrite it in more obvious way. KDBUS_CONN_MAX_FDS_PER_USER is
   checked at compile time to fill in quota->fds type (there is
   BUILD_BUG_ON), so no further checks for quota->fds overflow are
   needed.

Signed-off-by: Sergei Zviagintsev <sergei@xxxxxxxx>
---
 ipc/kdbus/connection.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ipc/kdbus/connection.c b/ipc/kdbus/connection.c
index c57ff2c846ee..b32b4f981618 100644
--- a/ipc/kdbus/connection.c
+++ b/ipc/kdbus/connection.c
@@ -717,12 +717,12 @@ int kdbus_conn_quota_inc(struct kdbus_conn *c, struct kdbus_user *u,
 
 	if (available < quota->memory ||
 	    available - quota->memory < memory ||
-	    quota->memory + memory > U32_MAX)
+	    U32_MAX - quota->memory < memory)
 		return -ENOBUFS;
 	if (quota->msgs >= KDBUS_CONN_MAX_MSGS)
 		return -ENOBUFS;
-	if (quota->fds + fds < quota->fds ||
-	    quota->fds + fds > KDBUS_CONN_MAX_FDS_PER_USER)
+	if (quota->fds > KDBUS_CONN_MAX_FDS_PER_USER ||
+	    KDBUS_CONN_MAX_FDS_PER_USER - quota->fds < fds)
 		return -EMFILE;
 
 	quota->memory += memory;
-- 
1.8.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/