Hello Andrew, could you, please, propagate the patch in https://lkml.org/lkml/2015/3/29/189 to the MM tree.
It is independent of the other two patches in the patch series. Rework for the other patches was requested by Alexey Dobriyan in https://lkml.org/lkml/2015/3/31/251 Best regards Heinrich Schuchardt On 29.03.2015 21:28, Heinrich Schuchardt wrote: > When converting unsigned long to int overflows may occur. > These currently are not detected when writing to the sysctl > file system. > > E.g. on a system where int has 32 bits and long has 64 bits > echo 0x800001234 > /proc/sys/kernel/threads-max > has the same effect as > echo 0x1234 > /proc/sys/kernel/threads-max > > The patch adds the missing check in do_proc_dointvec_conv. > > With the patch an overflow will result in an error EINVAL when > writing to the the sysctl file system. > > Signed-off-by: Heinrich Schuchardt <[email protected]> > --- > kernel/sysctl.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/kernel/sysctl.c b/kernel/sysctl.c > index 4d9d139..2fd6b82 100644 > --- a/kernel/sysctl.c > +++ b/kernel/sysctl.c > @@ -1953,7 +1953,15 @@ static int do_proc_dointvec_conv(bool *negp, unsigned > long *lvalp, > int write, void *data) > { > if (write) { > - *valp = *negp ? -*lvalp : *lvalp; > + if (*negp) { > + if (*lvalp > (unsigned long) INT_MAX + 1) > + return -EINVAL; > + *valp = -*lvalp; > + } else { > + if (*lvalp > (unsigned long) INT_MAX) > + return -EINVAL; > + *valp = *lvalp; > + } > } else { > int val = *valp; > if (val < 0) { > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
