From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 606FCC41518 for ; Wed, 3 Mar 2021 00:36:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 38EFA64FB5 for ; Wed, 3 Mar 2021 00:36:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237366AbhCCAW6 (ORCPT ); Tue, 2 Mar 2021 19:22:58 -0500 Received: from mail.kernel.org ([198.145.29.99]:48512 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244439AbhCBMVD (ORCPT ); Tue, 2 Mar 2021 07:21:03 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 664EF64F97; Tue, 2 Mar 2021 11:58:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1614686308; bh=KOOSiL8u9hwyIFP3sn4UzV1lzfYZw2vsVtIAeMZSaNY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MWSFv4yFQFY74Bp/5MKDo5QeaRG9Qt9ZtVMWJXGzBS501Q3mx80KGEgmh3HtoYPvl UbduIZJrIRW6XZqgN7awY8y5G1qHwgIDxBWqzLKzFTMPeEI/pT5LJVcYMinCc19cSK aKeOZvM+je7N52almOD5BgpAHwgK9sUMo8zS5vt1DFP5BcO2uJ4fyop7VHZ5ez1ZHF C3GKZHQxno22YZEXlb34rlzEDg/9UGTPIM7/H0d7QUmYEVkE5r15mOggUNf7MJf01F sFFNSQaTDPPIHnfEdw23ayM+x8yC2mo3oCM0tRH9UrDZpSu6zn8HE3ClKbYw9vIbHy o5W5ernqb+mUw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Lin Feng , Alexey Dobriyan , "Eric W. Biederman" , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH AUTOSEL 5.4 29/33] sysctl.c: fix underflow value setting risk in vm_table Date: Tue, 2 Mar 2021 06:57:45 -0500 Message-Id: <20210302115749.62653-29-sashal@kernel.org> X-Mailer: git-send-email 2.30.1 In-Reply-To: <20210302115749.62653-1-sashal@kernel.org> References: <20210302115749.62653-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lin Feng [ Upstream commit 3b3376f222e3ab58367d9dd405cafd09d5e37b7c ] Apart from subsystem specific .proc_handler handler, all ctl_tables with extra1 and extra2 members set should use proc_dointvec_minmax instead of proc_dointvec, or the limit set in extra* never work and potentially echo underflow values(negative numbers) is likely make system unstable. Especially vfs_cache_pressure and zone_reclaim_mode, -1 is apparently not a valid value, but we can set to them. And then kernel may crash. # echo -1 > /proc/sys/vm/vfs_cache_pressure Link: https://lkml.kernel.org/r/20201223105535.2875-1-linf@wangsu.com Signed-off-by: Lin Feng Cc: Alexey Dobriyan Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- kernel/sysctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 70665934d53e..eae6a078619f 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1563,7 +1563,7 @@ static struct ctl_table vm_table[] = { .data = &block_dump, .maxlen = sizeof(block_dump), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, }, { @@ -1571,7 +1571,7 @@ static struct ctl_table vm_table[] = { .data = &sysctl_vfs_cache_pressure, .maxlen = sizeof(sysctl_vfs_cache_pressure), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, }, #if defined(HAVE_ARCH_PICK_MMAP_LAYOUT) || \ @@ -1581,7 +1581,7 @@ static struct ctl_table vm_table[] = { .data = &sysctl_legacy_va_layout, .maxlen = sizeof(sysctl_legacy_va_layout), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, }, #endif @@ -1591,7 +1591,7 @@ static struct ctl_table vm_table[] = { .data = &node_reclaim_mode, .maxlen = sizeof(node_reclaim_mode), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, }, { -- 2.30.1