Commit 2bc4fc60 authored by Zev Weiss's avatar Zev Weiss Committed by Linus Torvalds

kernel/sysctl.c: define minmax conv functions in terms of non-minmax versions

do_proc_do[u]intvec_minmax_conv() had included open-coded versions of
do_proc_do[u]intvec_conv(); the duplication led to buggy inconsistencies
(missing range checks).  To reduce the likelihood of such problems in the
future, we can instead refactor both to be defined in terms of their
non-bounded counterparts (plus the added check).

Link: http://lkml.kernel.org/r/20190207165138.5oud57vq4ozwb4kh@hatter.bewilderbeest.netSigned-off-by: default avatarZev Weiss <zev@bewilderbeest.net>
Cc: Brendan Higgins <brendanhiggins@google.com>
Cc: Iurii Zaikin <yzaikin@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 8cf7630b
...@@ -2643,32 +2643,25 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp, ...@@ -2643,32 +2643,25 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp,
int *valp, int *valp,
int write, void *data) int write, void *data)
{ {
int tmp, ret;
struct do_proc_dointvec_minmax_conv_param *param = data; struct do_proc_dointvec_minmax_conv_param *param = data;
/*
* If writing, first do so via a temporary local int so we can
* bounds-check it before touching *valp.
*/
int *ip = write ? &tmp : valp;
ret = do_proc_dointvec_conv(negp, lvalp, ip, write, data);
if (ret)
return ret;
if (write) { if (write) {
int val; if ((param->min && *param->min > tmp) ||
if (*negp) { (param->max && *param->max < tmp))
if (*lvalp > (unsigned long) INT_MAX + 1)
return -EINVAL; return -EINVAL;
val = -*lvalp; *valp = tmp;
} else {
if (*lvalp > (unsigned long) INT_MAX)
return -EINVAL;
val = *lvalp;
}
if ((param->min && *param->min > val) ||
(param->max && *param->max < val))
return -EINVAL;
*valp = val;
} else {
int val = *valp;
if (val < 0) {
*negp = true;
*lvalp = -(unsigned long)val;
} else {
*negp = false;
*lvalp = (unsigned long)val;
}
} }
return 0; return 0;
} }
...@@ -2717,22 +2710,22 @@ static int do_proc_douintvec_minmax_conv(unsigned long *lvalp, ...@@ -2717,22 +2710,22 @@ static int do_proc_douintvec_minmax_conv(unsigned long *lvalp,
unsigned int *valp, unsigned int *valp,
int write, void *data) int write, void *data)
{ {
int ret;
unsigned int tmp;
struct do_proc_douintvec_minmax_conv_param *param = data; struct do_proc_douintvec_minmax_conv_param *param = data;
/* write via temporary local uint for bounds-checking */
unsigned int *up = write ? &tmp : valp;
if (write) { ret = do_proc_douintvec_conv(lvalp, up, write, data);
unsigned int val = *lvalp; if (ret)
return ret;
if (*lvalp > UINT_MAX)
return -EINVAL;
if ((param->min && *param->min > val) || if (write) {
(param->max && *param->max < val)) if ((param->min && *param->min > tmp) ||
(param->max && *param->max < tmp))
return -ERANGE; return -ERANGE;
*valp = val; *valp = tmp;
} else {
unsigned int val = *valp;
*lvalp = (unsigned long) val;
} }
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment