Messages in this thread | | | Date | Tue, 31 Mar 2015 19:12:59 +0200 | From | Heinrich Schuchardt <> | Subject | Fwd: [PATCH 3/3] sysctl: detect overflows when converting to int |
| |
Hello Andrew,
could you, please, propagate the patch in https://lkml.org/lkml/2015/3/29/189 to the MM tree.
It is independent of the other two patches in the patch series. Rework for the other patches was requested by Alexey Dobriyan in https://lkml.org/lkml/2015/3/31/251
Best regards
Heinrich Schuchardt
On 29.03.2015 21:28, Heinrich Schuchardt wrote: > When converting unsigned long to int overflows may occur. > These currently are not detected when writing to the sysctl > file system. > > E.g. on a system where int has 32 bits and long has 64 bits > echo 0x800001234 > /proc/sys/kernel/threads-max > has the same effect as > echo 0x1234 > /proc/sys/kernel/threads-max > > The patch adds the missing check in do_proc_dointvec_conv. > > With the patch an overflow will result in an error EINVAL when > writing to the the sysctl file system. > > Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> > --- > kernel/sysctl.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/kernel/sysctl.c b/kernel/sysctl.c > index 4d9d139..2fd6b82 100644 > --- a/kernel/sysctl.c > +++ b/kernel/sysctl.c > @@ -1953,7 +1953,15 @@ static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp, > int write, void *data) > { > if (write) { > - *valp = *negp ? -*lvalp : *lvalp; > + if (*negp) { > + if (*lvalp > (unsigned long) INT_MAX + 1) > + return -EINVAL; > + *valp = -*lvalp; > + } else { > + if (*lvalp > (unsigned long) INT_MAX) > + return -EINVAL; > + *valp = *lvalp; > + } > } else { > int val = *valp; > if (val < 0) { >
| |