Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1419875

[PATCH 1/1] kernel/sysctl.c: avoid overflow

Show all headers | View raw

An undetected overflow may occur in do_proc_dointvec_minmax_conv_param.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
---
 kernel/sysctl.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 35f0dcb..a9e7be3 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2313,7 +2313,17 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp,
 {
 	struct do_proc_dointvec_minmax_conv_param *param = data;
 	if (write) {
-		int val = *negp ? -*lvalp : *lvalp;
+		int val;
+
+		if (*negp) {
+			if (*lvalp > (unsigned long) INT_MAX + 1)
+				return -EINVAL;
+			val = -*lvalp;
+		} else {
+			if (*lvalp > (unsigned long) INT_MAX)
+				return -EINVAL;
+			val = *lvalp;
+		}
 		if ((param->min && *param->min > val) ||
 		    (param->max && *param->max < val))
 			return -EINVAL;
-- 
2.1.4

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH 1/1] kernel/sysctl.c: avoid overflow Heinrich Schuchardt <xypron.glpk@gmx.de> - 2016-06-11 03:40 +0200
  Re: [PATCH 1/1] kernel/sysctl.c: avoid overflow Kees Cook <keescook@chromium.org> - 2016-06-14 20:40 +0200
  Re: [PATCH 1/1] kernel/sysctl.c: avoid overflow Andrew Morton <akpm@linux-foundation.org> - 2016-06-14 22:20 +0200
    Re: [PATCH 1/1] kernel/sysctl.c: avoid overflow Willy Tarreau <w@1wt.eu> - 2016-06-14 22:50 +0200
      Re: [PATCH 1/1] kernel/sysctl.c: avoid overflow Dave Young <dyoung@redhat.com> - 2016-06-15 10:40 +0200
        Re: [PATCH 1/1] kernel/sysctl.c: avoid overflow Willy Tarreau <w@1wt.eu> - 2016-06-15 10:50 +0200
          Re: [PATCH 1/1] kernel/sysctl.c: avoid overflow Dave Young <dyoung@redhat.com> - 2016-06-15 11:00 +0200
    Re: [PATCH 1/1] kernel/sysctl.c: avoid overflow Kees Cook <keescook@chromium.org> - 2016-06-14 23:10 +0200

csiph-web