From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.7 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C2E3FC31E4A for ; Thu, 13 Jun 2019 16:21:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9B43920665 for ; Thu, 13 Jun 2019 16:21:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1560442910; bh=JpX2HqfV0kfphin4vUFM4wFsB69DCZ4xUn8eM4NjeXE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=v0YejE07FEzUBesBCuHxmAbsBiorSzD+wD86mAECb4R9DbPmMDIFdq4fyT1pBsQvx QNMHgb22OwrPy3UWzl69lYV4kPSlkLSj9gpfShPtY1XJpge1K3LLNpRdCL6/yEtSo0 /1c87xRUxRhyUZiqvWnvpptcWUq3EpDwvFCaam4A= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731057AbfFMQVt (ORCPT ); Thu, 13 Jun 2019 12:21:49 -0400 Received: from mail.kernel.org ([198.145.29.99]:56168 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731054AbfFMIik (ORCPT ); Thu, 13 Jun 2019 04:38:40 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 49F0B2147A; Thu, 13 Jun 2019 08:38:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1560415119; bh=JpX2HqfV0kfphin4vUFM4wFsB69DCZ4xUn8eM4NjeXE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bP58H/xn7K9cvw9hMgPeAkdAqTLiKCsQexxu41nm4DQ4vfb/r+nIN2QKihhg1GKQc em7j9R/tCyzRCbfpo8svKvz2k32rXh0frDlwWRgXchZm+Yea7agMMM2hj9t1VPVZlU z8uoGDxQqYUDLBmY4jsTZn8thDT6KydWNKnKNgmE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christian Brauner , Luis Chamberlain , Kees Cook , Alexey Dobriyan , Al Viro , Dominik Brodowski , "Eric W. Biederman" , Joe Lawrence , Waiman Long , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH 4.19 003/118] sysctl: return -EINVAL if val violates minmax Date: Thu, 13 Jun 2019 10:32:21 +0200 Message-Id: <20190613075643.856357641@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190613075643.642092651@linuxfoundation.org> References: <20190613075643.642092651@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org [ Upstream commit e260ad01f0aa9e96b5386d5cd7184afd949dc457 ] Currently when userspace gives us a values that overflow e.g. file-max and other callers of __do_proc_doulongvec_minmax() we simply ignore the new value and leave the current value untouched. This can be problematic as it gives the illusion that the limit has indeed be bumped when in fact it failed. This commit makes sure to return EINVAL when an overflow is detected. Please note that this is a userspace facing change. Link: http://lkml.kernel.org/r/20190210203943.8227-4-christian@brauner.io Signed-off-by: Christian Brauner Acked-by: Luis Chamberlain Cc: Kees Cook Cc: Alexey Dobriyan Cc: Al Viro Cc: Dominik Brodowski Cc: "Eric W. Biederman" Cc: Joe Lawrence Cc: Waiman Long Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- kernel/sysctl.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 9a85c7ae7362..f8576509c7be 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2791,8 +2791,10 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int if (neg) continue; val = convmul * val / convdiv; - if ((min && val < *min) || (max && val > *max)) - continue; + if ((min && val < *min) || (max && val > *max)) { + err = -EINVAL; + break; + } *i = val; } else { val = convdiv * (*i) / convmul; -- 2.20.1