From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 80152C2BA17 for ; Wed, 3 Mar 2021 00:21:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3B98964FAB for ; Wed, 3 Mar 2021 00:21:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236916AbhCCAQR (ORCPT ); Tue, 2 Mar 2021 19:16:17 -0500 Received: from mail.kernel.org ([198.145.29.99]:44812 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1446883AbhCBMNt (ORCPT ); Tue, 2 Mar 2021 07:13:49 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8774164F79; Tue, 2 Mar 2021 11:57:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1614686262; bh=af5MmW1uADoQH6OJiahZC4FogAvJbrh1pn221h0sX8s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I6ldwKavxKcwly4q1JkEyKq1yjAhnJ7a3XBX+LzlLgGNrGQnlNrv3aKmRMuq9VFU0 ZbtJMcMCXilKI5759H3HV99vXb2pHhsgecD/f5yPbBz3wt/YoYDMTcSQLIyrGClA39 XrlRaJBqwbADygq3AMXJ+t0ZyFp+1lzdB9BaR68BvE9UI8bwBwX9qOp0/WCb6d4F0b NK/wETi9shr60+GleRIKy0BSPXrubTSjihXnQNJMOyKqAH0lxE9bsoE/42yltI56tb 6uokaU5JV3rwq6KpasuLuGKjqyzBgQsqYH/opZJ1pJ2+EWl6ZVCWH7OkzlnvmK1Bcw /g2MgKAuiUTqg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Lin Feng , Alexey Dobriyan , "Eric W. Biederman" , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH AUTOSEL 5.10 43/47] sysctl.c: fix underflow value setting risk in vm_table Date: Tue, 2 Mar 2021 06:56:42 -0500 Message-Id: <20210302115646.62291-43-sashal@kernel.org> X-Mailer: git-send-email 2.30.1 In-Reply-To: <20210302115646.62291-1-sashal@kernel.org> References: <20210302115646.62291-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lin Feng [ Upstream commit 3b3376f222e3ab58367d9dd405cafd09d5e37b7c ] Apart from subsystem specific .proc_handler handler, all ctl_tables with extra1 and extra2 members set should use proc_dointvec_minmax instead of proc_dointvec, or the limit set in extra* never work and potentially echo underflow values(negative numbers) is likely make system unstable. Especially vfs_cache_pressure and zone_reclaim_mode, -1 is apparently not a valid value, but we can set to them. And then kernel may crash. # echo -1 > /proc/sys/vm/vfs_cache_pressure Link: https://lkml.kernel.org/r/20201223105535.2875-1-linf@wangsu.com Signed-off-by: Lin Feng Cc: Alexey Dobriyan Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- kernel/sysctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index afad085960b8..b9306d2bb426 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2951,7 +2951,7 @@ static struct ctl_table vm_table[] = { .data = &block_dump, .maxlen = sizeof(block_dump), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, }, { @@ -2959,7 +2959,7 @@ static struct ctl_table vm_table[] = { .data = &sysctl_vfs_cache_pressure, .maxlen = sizeof(sysctl_vfs_cache_pressure), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, }, #if defined(HAVE_ARCH_PICK_MMAP_LAYOUT) || \ @@ -2969,7 +2969,7 @@ static struct ctl_table vm_table[] = { .data = &sysctl_legacy_va_layout, .maxlen = sizeof(sysctl_legacy_va_layout), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, }, #endif @@ -2979,7 +2979,7 @@ static struct ctl_table vm_table[] = { .data = &node_reclaim_mode, .maxlen = sizeof(node_reclaim_mode), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, }, { -- 2.30.1