lkml.org 
[lkml]   [2015]   [Mar]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectFwd: [PATCH 3/3] sysctl: detect overflows when converting to int
Hello Andrew,

could you, please, propagate the patch in
https://lkml.org/lkml/2015/3/29/189
to the MM tree.

It is independent of the other two patches in the patch series.
Rework for the other patches was requested by Alexey Dobriyan in
https://lkml.org/lkml/2015/3/31/251

Best regards

Heinrich Schuchardt

On 29.03.2015 21:28, Heinrich Schuchardt wrote:
> When converting unsigned long to int overflows may occur.
> These currently are not detected when writing to the sysctl
> file system.
>
> E.g. on a system where int has 32 bits and long has 64 bits
> echo 0x800001234 > /proc/sys/kernel/threads-max
> has the same effect as
> echo 0x1234 > /proc/sys/kernel/threads-max
>
> The patch adds the missing check in do_proc_dointvec_conv.
>
> With the patch an overflow will result in an error EINVAL when
> writing to the the sysctl file system.
>
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
> ---
> kernel/sysctl.c | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
> index 4d9d139..2fd6b82 100644
> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -1953,7 +1953,15 @@ static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp,
> int write, void *data)
> {
> if (write) {
> - *valp = *negp ? -*lvalp : *lvalp;
> + if (*negp) {
> + if (*lvalp > (unsigned long) INT_MAX + 1)
> + return -EINVAL;
> + *valp = -*lvalp;
> + } else {
> + if (*lvalp > (unsigned long) INT_MAX)
> + return -EINVAL;
> + *valp = *lvalp;
> + }
> } else {
> int val = *valp;
> if (val < 0) {
>



\
 
 \ /
  Last update: 2015-03-31 19:41    [W:0.090 / U:0.304 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site