linux-kernel - overflow on proc_nr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 11 Oct 2018 16:10:15 +0200
From:   Christian Brauner <christian@...uner.io>
To:     linux-kernel@...r.kernel.org, Kees Cook <keescook@...omium.org>,
        "Eric W . Biederman" <ebiederm@...ssion.com>
Subject: overflow on proc_nr_files

Hey,

I've just got pinged by Lennart who discovered that you can get your
system into an unuseable state by writing something that exceeds a s64
into /proc/sys/fs/file-max. Say,

echo 20000000000000000000 > /proc/sys/fs/file-max

which will trigger an overflow and percpu_counter_read_positive() will
return 0 and cat /proc/sys/fs/file-max will return 0.

That effectively means you write that number and it succeeds and all is
well and a few seconds/minutes later your system just dies or gets into
an unuseable state pretty quickly

I wonder if we shouldn't accept overflows or - if we have no way in this
codepath to detect them - set it to some pre-defined hard-coded value.

Or maybe this is even a known issue and by design but before I work on a
patch here I just wanted to check.

Christian