netdev - [PATCH net 1/1] proc/sysctl: Fix the int overflow for jiffies conversion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Thu, 30 Mar 2017 08:39:44 +0800
From:   gfree.wind@...mail.com
To:     davem@...emloft.net, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, gfree.wind@...mail.com
Cc:     Gao Feng <fgao@...ai8.com>
Subject: [PATCH net 1/1] proc/sysctl: Fix the int overflow for jiffies conversion

From: Gao Feng <fgao@...ai8.com>

The function do_proc_dointvec_jiffies_conv uses LONG_MX/HZ as the
max value to avoid overflow. But actually the *valp is int type, so
it still causes overflow.

For example,
echo 2147483647 > ./sys/net/ipv4/tcp_keepalive_time
Then,
cat ./sys/net/ipv4/tcp_keepalive_time
The output is "-1", it is not expected.

Now use INT_MAX/HZ as the max value instead LONG_MAX/HZ to fix it.

Signed-off-by: Gao Feng <fgao@...ai8.com>
---
 kernel/sysctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index acf0a5a..60474df 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2571,7 +2571,7 @@ static int do_proc_dointvec_jiffies_conv(bool *negp, unsigned long *lvalp,
 					 int write, void *data)
 {
 	if (write) {
-		if (*lvalp > LONG_MAX / HZ)
+		if (*lvalp > INT_MAX / HZ)
 			return 1;
 		*valp = *negp ? -(*lvalp*HZ) : (*lvalp*HZ);
 	} else {
-- 
1.9.1