@@ -143,7 +143,7 @@ int misc_cg_try_charge(enum misc_res_type type, struct misc_cg *cg,
struct misc_cg *i, *j;
int ret;
struct misc_res *res;
- int new_usage;
+ long new_usage;
if (!(valid_type(type) && cg && READ_ONCE(misc_res_capacity[type])))
return -EINVAL;
@@ -156,7 +156,8 @@ int misc_cg_try_charge(enum misc_res_type type, struct misc_cg *cg,
new_usage = atomic_long_add_return(amount, &res->usage);
if (new_usage > READ_ONCE(res->max) ||
- new_usage > READ_ONCE(misc_res_capacity[type])) {
+ new_usage > READ_ONCE(misc_res_capacity[type]) ||
+ new_usage < 0) {
ret = -EBUSY;
goto err_charge;
}
The variable 'new_usage' in misc_cg_try_charge() may overflow if it becomes above INT_MAX. This was observed when I implement the new SGX EPC cgroup[1] as a misc cgroup and test on a platform with large SGX EPC sizes. Change type of new_usage to long from int and check overflow. Fixes: a72232eabdfc ("cgroup: Add misc cgroup controller") Signed-off-by: Haitao Huang <haitao.huang@linux.intel.com> [1] https://lore.kernel.org/linux-sgx/20230712230202.47929-1-haitao.huang@linux.intel.com/ --- kernel/cgroup/misc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)