From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F3D3C433E0 for ; Tue, 2 Mar 2021 14:11:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3C59564EF4 for ; Tue, 2 Mar 2021 14:11:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1578339AbhCBOJw (ORCPT ); Tue, 2 Mar 2021 09:09:52 -0500 Received: from mail.kernel.org ([198.145.29.99]:50760 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1383917AbhCBMcs (ORCPT ); Tue, 2 Mar 2021 07:32:48 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id AC24F64F48; Tue, 2 Mar 2021 11:56:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1614686199; bh=Ro1bwW+9C73MscFvaHBeTX5xRYiajACd+SxBlI51AL4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G27MTIQqbjLieKajVXHLe4u6lK32HPEwf0a6isqnhPlp0P7dJQxC7jsjcMvW6fm5X Dh3kM1cuYHO8X+fuzatY9i7urabHYvuh/qNU72W8LBvWyFHzZ6ISaciAXbT13dANvt te0pRG+YiDigIgPZQiz8sT1hfTYTZdESEQrSYHfpCRuSAtPo5Q/4DsPxS/0e7AvV6U YqK1T5v/U0uYGHQd1LK1Ds8gJgPpIYzQWMxhGuxOKYd5+JNsgQnhQhcPxZBxYhsDGa i8Kr/AeK2cOPz08r1UtlK9Blu1rPUxGYJUaADpGjRLvSrA2upD/z14Lg1JySGz0vGc k7al1bOBtqmuA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Lin Feng , Alexey Dobriyan , "Eric W. Biederman" , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH AUTOSEL 5.11 48/52] sysctl.c: fix underflow value setting risk in vm_table Date: Tue, 2 Mar 2021 06:55:29 -0500 Message-Id: <20210302115534.61800-48-sashal@kernel.org> X-Mailer: git-send-email 2.30.1 In-Reply-To: <20210302115534.61800-1-sashal@kernel.org> References: <20210302115534.61800-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Lin Feng [ Upstream commit 3b3376f222e3ab58367d9dd405cafd09d5e37b7c ] Apart from subsystem specific .proc_handler handler, all ctl_tables with extra1 and extra2 members set should use proc_dointvec_minmax instead of proc_dointvec, or the limit set in extra* never work and potentially echo underflow values(negative numbers) is likely make system unstable. Especially vfs_cache_pressure and zone_reclaim_mode, -1 is apparently not a valid value, but we can set to them. And then kernel may crash. # echo -1 > /proc/sys/vm/vfs_cache_pressure Link: https://lkml.kernel.org/r/20201223105535.2875-1-linf@wangsu.com Signed-off-by: Lin Feng Cc: Alexey Dobriyan Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- kernel/sysctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index c9fbdd848138..62fbd09b5dc1 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2962,7 +2962,7 @@ static struct ctl_table vm_table[] = { .data = &block_dump, .maxlen = sizeof(block_dump), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, }, { @@ -2970,7 +2970,7 @@ static struct ctl_table vm_table[] = { .data = &sysctl_vfs_cache_pressure, .maxlen = sizeof(sysctl_vfs_cache_pressure), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, }, #if defined(HAVE_ARCH_PICK_MMAP_LAYOUT) || \ @@ -2980,7 +2980,7 @@ static struct ctl_table vm_table[] = { .data = &sysctl_legacy_va_layout, .maxlen = sizeof(sysctl_legacy_va_layout), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, }, #endif @@ -2990,7 +2990,7 @@ static struct ctl_table vm_table[] = { .data = &node_reclaim_mode, .maxlen = sizeof(node_reclaim_mode), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, }, { -- 2.30.1