linux-kernel - [RFC PATCH] kernel/sysctl: detect overflows when converting to uint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 5 Dec 2016 18:42:41 +0800
From:   Yisheng Xie <xieyisheng1@...wei.com>
To:     <linux-kernel@...r.kernel.org>
CC:     <akpm@...ux-foundation.org>, <acme@...hat.com>,
        <mgorman@...hsingularity.net>, <viro@...iv.linux.org.uk>,
        <hannes@...xchg.org>, <ebiederm@...ssion.com>,
        <bristot@...hat.com>, <subashab@...eaurora.org>,
        <dcashman@...gle.com>, <w@....eu>, <arnd@...db.de>,
        <guohanjun@...wei.com>, <qiuxishi@...wei.com>
Subject: [RFC PATCH] kernel/sysctl: detect overflows when converting to uint

Commit 230633d109e3 ("kernel/sysctl.c: detect overflows when converting
to int") prevented writing to sysctl entries when integer overflow occurs.
However, this does not apply to unsigned integers.

To fix this, commit e7d316a02f68 ("sysctl: handle error writing UINT_MAX
to u32 fields") introduce a new proc handler proc_douintvec, however do
not handle the overflowing of unsigned int.

E.g. on a system where int has 32 bits and long has 64 bits
  echo 0x100001234 > /proc/sys/net/core/xfrm_aevent_etime
has the same effect as
  echo 0x1234 > /proc/sys/net/core/xfrm_aevent_etime

The patch adds the missing check in do_proc_douintvec_conv.

With the patch an overflow of unsigned int will result in an error
EINVAL when writing to the the sysctl file system.

Signed-off-by: Yisheng Xie <xieyisheng1@...wei.com>
---
 kernel/sysctl.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 706309f..762ecf3 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2146,6 +2146,10 @@ static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp,
 	if (write) {
 		if (*negp)
 			return -EINVAL;
+
+		if (*lvalp > (unsigned long) UINT_MAX)
+			return -EINVAL;
+
 		*valp = *lvalp;
 	} else {
 		unsigned int val = *valp;
-- 
1.7.12.4