[PATCH 3/3] Range checking in do_proc_dointvec_(userhz_)jiffies_conv

[Bart Samwel <bart@samwel.tk>]

When (integer) sysctl values are in either seconds or centiseconds,
but represented internally as jiffies, the allowable value range
is decreased. This patch adds range checks to the conversion
routines.

For values in seconds: maximum LONG_MAX / HZ.

For values in centiseconds: maximum (LONG_MAX / HZ) * USER_HZ.


(BTW, does anyone else feel that an interface in seconds should not be
accepting negative values?)


Signed-off-by: Bart Samwel <bart@samwel.tk>


--- linux-2.6.16-rc1.orig/kernel/sysctl.c	2006-01-28 01:47:24.000000000 +0100
+++ linux-2.6.16-rc1/kernel/sysctl.c	2006-01-28 02:03:14.000000000 +0100
@@ -2008,6 +2008,8 @@
  					 int write, void *data)
  {
  	if (write) {
+		if (*lvalp > LONG_MAX / HZ)
+			return 1;		
  		*valp = *negp ? -(*lvalp*HZ) : (*lvalp*HZ);
  	} else {
  		int val = *valp;
@@ -2029,6 +2031,8 @@
  						int write, void *data)
  {
  	if (write) {
+		if (USER_HZ < HZ && *lvalp > (LONG_MAX / HZ) * USER_HZ)
+			return 1;
  		*valp = clock_t_to_jiffies(*negp ? -*lvalp : *lvalp);
  	} else {
  		int val = *valp;