[PATCH v2] sysctl: fix check against uninitialized variable in proc_do_large_bitmap

[PATCH v2] sysctl: fix check against uninitialized variable in proc_do_large_bitmap

[Marc Buerg]

proc_do_large_bitmap() does not initialize variable c, which is expected
to be set to a trailing character by proc_get_long().

However, proc_get_long() only sets c when the input buffer contains a
trailing character after the parsed value.

If c is not initialized it may happen to contain a '-'. If this is the
case proc_do_large_bitmap() expects to be able to parse a second part of
the input buffer. If there is no second part an unjustified -EINVAL will
be returned.

Add check that left is non-zero before checking c, as proc_get_long()
ensures that the passed left is non-zero, if a trailing character
exists.

---
Fixes: 9f977fb7ae9d ("sysctl: add proc_do_large_bitmap")
Signed-off-by: Marc Buerg <buermarc@googlemail.com>
---
Changes in v2:
- Drop initialization of c to 0
- Include checking that left is non-zero before checking against c
- Link to v1: https://lore.kernel.org/r/20260312-fix-uninitialized-variable-in-proc_do_large_bitmap-v1-1-35ad2dddaf21@googlemail.com
---
 kernel/sysctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 9d3a666ffde1..dd337a63da41 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1171,7 +1171,7 @@ int proc_do_large_bitmap(const struct ctl_table *table, int dir,
 				left--;
 			}
 
-			if (c == '-') {
+			if (left && c == '-') {
 				err = proc_get_long(&p, &left, &val_b,
 						     &neg, tr_b, sizeof(tr_b),
 						     &c);

---
base-commit: 80234b5ab240f52fa45d201e899e207b9265ef91
change-id: 20260312-fix-uninitialized-variable-in-proc_do_large_bitmap-30c6ef4ac1c5

Best regards,
-- 
buermarc <buermarc@googlemail.com>

Re: [PATCH v2] sysctl: fix check against uninitialized variable in proc_do_large_bitmap

[Peter Seiderer]

Hello Marc,

thanks for new patch iteration, some minor comments below...

On Tue, 17 Mar 2026 22:39:32 +0100, Marc Buerg <buermarc@googlemail.com> wrote:

> proc_do_large_bitmap() does not initialize variable c, which is expected
> to be set to a trailing character by proc_get_long().
> 
> However, proc_get_long() only sets c when the input buffer contains a
> trailing character after the parsed value.
> 
> If c is not initialized it may happen to contain a '-'. If this is the
> case proc_do_large_bitmap() expects to be able to parse a second part of
> the input buffer. If there is no second part an unjustified -EINVAL will
> be returned.
> 
> Add check that left is non-zero before checking c, as proc_get_long()
> ensures that the passed left is non-zero, if a trailing character
> exists.
> 
> ---

All below this '---' comment marker will be dropped when applied
(specially the 'Fixes:' and 'Signed-off-by:' tags)...

> Fixes: 9f977fb7ae9d ("sysctl: add proc_do_large_bitmap")
> Signed-off-by: Marc Buerg <buermarc@googlemail.com>
> ---
> Changes in v2:
> - Drop initialization of c to 0
> - Include checking that left is non-zero before checking against c
> - Link to v1: https://lore.kernel.org/r/20260312-fix-uninitialized-variable-in-proc_do_large_bitmap-v1-1-35ad2dddaf21@googlemail.com

I personally found some of the commit message text from v1 very
nice/helpful, specially the part about the writing to
/proc/sys/net/ipv4/ip_local_reserved_ports to trigger/observe the bug and
the maybe condition on CONFIG_INIT_STACK_NONE=y...

Besides that you can add my

Reviewed-by: Peter Seiderer <ps.report@gmx.net>

Regards,
Peter

> ---
>  kernel/sysctl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
> index 9d3a666ffde1..dd337a63da41 100644
> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -1171,7 +1171,7 @@ int proc_do_large_bitmap(const struct ctl_table *table, int dir,
>  				left--;
>  			}
>  
> -			if (c == '-') {
> +			if (left && c == '-') {
>  				err = proc_get_long(&p, &left, &val_b,
>  						     &neg, tr_b, sizeof(tr_b),
>  						     &c);
> 
> ---
> base-commit: 80234b5ab240f52fa45d201e899e207b9265ef91
> change-id: 20260312-fix-uninitialized-variable-in-proc_do_large_bitmap-30c6ef4ac1c5
> 
> Best regards,

Re: [PATCH v2] sysctl: fix check against uninitialized variable in proc_do_large_bitmap

[buermarc]

From: Marc Buerg <buermarc@googlemail.com>

Hello Peter,

Thanks for the feedback :)

On Thu, 19 Mar 2026 19:58:41 +0100, Peter Seiderer <ps.report@gmx.net>
wrote:

> I personally found some of the commit message text from v1 very
> nice/helpful, specially the part about the writing to
> /proc/sys/net/ipv4/ip_local_reserved_ports to trigger/observe the bug and
> the maybe condition on CONFIG_INIT_STACK_NONE=3Dy...

I understand, I'll adapt it slightly to better fit the new patch.

> Besides that you can add my
>
> Reviewed-by: Peter Seiderer <ps.report@gmx.net>

Will add it and send a new patch version.

Best Regards,
Marc