[PATCH] cgroup/rdma: fix integer overflow in rdmacg_try_charge()

[PATCH] cgroup/rdma: fix integer overflow in rdmacg_try_charge()

[cuitao]

The expression `rpool->resources[index].usage + 1` is computed in int
arithmetic before being assigned to s64 variable `new`. When usage equals
INT_MAX (the default "max" value), the addition overflows to INT_MIN.
This negative value then passes the `new > max` check incorrectly,
allowing a charge that should be rejected and corrupting usage to
negative.

Fix by casting usage to s64 before the addition so the arithmetic is
done in 64-bit.

Signed-off-by: cuitao <cuitao@kylinos.cn>
---
 kernel/cgroup/rdma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/cgroup/rdma.c b/kernel/cgroup/rdma.c
index 09258eebb5c7..7d21a0db3cef 100644
--- a/kernel/cgroup/rdma.c
+++ b/kernel/cgroup/rdma.c
@@ -283,7 +283,7 @@ int rdmacg_try_charge(struct rdma_cgroup **rdmacg,
 			ret = PTR_ERR(rpool);
 			goto err;
 		} else {
-			new = rpool->resources[index].usage + 1;
+			new = (s64)rpool->resources[index].usage + 1;
 			if (new > rpool->resources[index].max) {
 				ret = -EAGAIN;
 				goto err;
-- 
2.43.0

Re: [PATCH] cgroup/rdma: fix integer overflow in rdmacg_try_charge()

[Michal Koutný]

[-- Attachment #1: Type: text/plain, Size: 812 bytes --]

On Tue, Apr 14, 2026 at 09:53:27AM +0800, cuitao <cuitao@kylinos.cn> wrote:
> The expression `rpool->resources[index].usage + 1` is computed in int
> arithmetic before being assigned to s64 variable `new`. When usage equals
> INT_MAX (the default "max" value), the addition overflows to INT_MIN.
> This negative value then passes the `new > max` check incorrectly,
> allowing a charge that should be rejected and corrupting usage to
> negative.
> 
> Fix by casting usage to s64 before the addition so the arithmetic is
> done in 64-bit.

Thanks.

Fixes: 39d3e7584a686 ("rdmacg: Added rdma cgroup controller")

> 
> Signed-off-by: cuitao <cuitao@kylinos.cn>
> ---
>  kernel/cgroup/rdma.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Michal Koutný <mkoutny@suse.com>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 265 bytes --]

Re: [PATCH] cgroup/rdma: fix integer overflow in rdmacg_try_charge()

[Tejun Heo]

Hello,

> cuitao (1):
>   cgroup/rdma: fix integer overflow in rdmacg_try_charge()

Applied to cgroup/for-7.1-fixes.

Thanks.

--
tejun