linux-kernel - [PATCH] proc/sysctl: fix return error for proc_doulongvec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1544081775-15720-1-git-send-email-cheng.lin130@zte.com.cn>
Date:   Thu, 6 Dec 2018 15:36:15 +0800
From:   Cheng Lin <cheng.lin130@....com.cn>
To:     mcgrof@...nel.org
Cc:     keescook@...omium.org, linux-kernel@...r.kernel.org,
        linux-fsdevel@...r.kernel.org, zhong.weidong@....com.cn,
        wang.yi59@....com.cn, Cheng Lin <cheng.lin130@....com.cn>
Subject: [PATCH] proc/sysctl: fix return error for proc_doulongvec_minmax

If the number of input parameters is less than the total
parameters, an EINVAL error will be returned.

e.g.
We use proc_doulongvec_minmax to pass up to two parameters
with kern_table.

{
	.procname       = "monitor_signals",
	.data           = &monitor_sigs,
	.maxlen         = 2*sizeof(unsigned long),
	.mode           = 0644,
	.proc_handler   = proc_doulongvec_minmax,
},

Reproduce:
When passing two parameters, it's work normal. But passing
only one parameter, an error "Invalid argument"(EINVAL) is
returned.

[root@...50 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals
[root@...50 ~]# cat /proc/sys/kernel/monitor_signals
1       2
[root@...50 ~]# echo 3 > /proc/sys/kernel/monitor_signals
-bash: echo: write error: Invalid argument
[root@...50 ~]# echo $?
1
[root@...50 ~]# cat /proc/sys/kernel/monitor_signals
3       2
[root@...50 ~]#

The following is the result after apply this patch. No error
is returned when the number of input parameters is less than
the total parameters.

[root@...50 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals
[root@...50 ~]# cat /proc/sys/kernel/monitor_signals
1       2
[root@...50 ~]# echo 3 > /proc/sys/kernel/monitor_signals
[root@...50 ~]# echo $?
0
[root@...50 ~]# cat /proc/sys/kernel/monitor_signals
3       2
[root@...50 ~]#

There are three processing functions dealing with digital parameters,
__do_proc_dointvec/__do_proc_douintvec/__do_proc_doulongvec_minmax.

This patch deals with __do_proc_doulongvec_minmax, just as
__do_proc_dointvec does, adding a check for parameters 'left'. In
__do_proc_douintvec, its code implementation explicitly does not
support multiple inputs.

static int __do_proc_douintvec(...){
         ...
         /*
          * Arrays are not supported, keep this simple. *Do not* add
          * support for them.
          */
         if (vleft != 1) {
                 *lenp = 0;
                 return -EINVAL;
         }
         ...
}

So, just __do_proc_doulongvec_minmax has the problem. And most use of
proc_doulongvec_minmax/proc_doulongvec_ms_jiffies_minmax just have one
parameter.

Signed-off-by: Cheng Lin <cheng.lin130@....com.cn>
---
 kernel/sysctl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 5fc724e..9ee261f 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2779,6 +2779,8 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
 			bool neg;

 			left -= proc_skip_spaces(&p);
+			if (!left)
+				break;

 			err = proc_get_long(&p, &left, &val, &neg,
 					     proc_wspace_sep,
-- 
1.8.3.1