linux-kernel - Re: [PATCH next] sysctl: add proc_dointvec_jiffies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <d5138655-41a8-0177-ae0d-c4674112bf56@huawei.com>
Date:   Wed, 15 May 2019 22:53:55 +0800
From:   Zhiqiang Liu <liuzhiqiang26@...wei.com>
To:     <mcgrof@...nel.org>, <keescook@...omium.org>,
        <linux-kernel@...r.kernel.org>, <linux-fsdevel@...r.kernel.org>,
        <ebiederm@...ssion.com>, <pbonzini@...hat.com>,
        <viro@...iv.linux.org.uk>, <adobriyan@...il.com>
CC:     <mingfangsen@...wei.com>, <wangxiaogang3@...wei.com>,
        "Zhoukang (A)" <zhoukang7@...wei.com>
Subject: Re: [PATCH next] sysctl: add proc_dointvec_jiffies_minmax to limit
 the min/max write value

Friendly ping...

在 2019/4/24 12:04, Zhiqiang Liu 写道:
> 
> Friendly ping...
> 
>> From: Zhiqiang Liu <liuzhiqiang26@...wei.com>
>>
>> In proc_dointvec_jiffies func, the write value is only checked
>> whether it is larger than INT_MAX. If the write value is less
>> than zero, it can also be successfully writen in the data.
>>
>> However, in some scenarios, users would adopt the data to
>> set timers or check whether time is expired. Generally, the data
>> will be cast to an unsigned type variable, then the negative data
>> becomes a very large unsigned value, which leads to long waits
>> or other unpredictable problems.
>>
>> Here, we add a new func, proc_dointvec_jiffies_minmax, to limit the
>> min/max write value, which is similar to the proc_dointvec_minmax func.
>>
>> Signed-off-by: Zhiqiang Liu <liuzhiqiang26@...wei.com>
>> Reported-by: Qiang Ning <ningqiang1@...wei.com>
>> Reviewed-by: Jie Liu <liujie165@...wei.com>
>> ---
>>  include/linux/sysctl.h |  2 ++
>>  kernel/sysctl.c        | 44 +++++++++++++++++++++++++++++++++++++++++++-
>>  2 files changed, 45 insertions(+), 1 deletion(-)
>>
>> diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
>> index b769ecf..8bde8a0 100644
>> --- a/include/linux/sysctl.h
>> +++ b/include/linux/sysctl.h
>> @@ -53,6 +53,8 @@ extern int proc_douintvec_minmax(struct ctl_table *table, int write,
>>  				 loff_t *ppos);
>>  extern int proc_dointvec_jiffies(struct ctl_table *, int,
>>  				 void __user *, size_t *, loff_t *);
>> +extern int proc_dointvec_jiffies_minmax(struct ctl_table *, int,
>> +				 void __user *, size_t *, loff_t *);
>>  extern int proc_dointvec_userhz_jiffies(struct ctl_table *, int,
>>  					void __user *, size_t *, loff_t *);
>>  extern int proc_dointvec_ms_jiffies(struct ctl_table *, int,
>> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
>> index c9ec050..8e1eb59 100644
>> --- a/kernel/sysctl.c
>> +++ b/kernel/sysctl.c
>> @@ -2967,10 +2967,15 @@ static int do_proc_dointvec_jiffies_conv(bool *negp, unsigned long *lvalp,
>>  					 int *valp,
>>  					 int write, void *data)
>>  {
>> +	struct do_proc_dointvec_minmax_conv_param *param = data;
>> +
>>  	if (write) {
>>  		if (*lvalp > INT_MAX / HZ)
>>  			return 1;
>>  		*valp = *negp ? -(*lvalp*HZ) : (*lvalp*HZ);
>> +		if ((param->min && (*param->min)*HZ > *valp) ||
>> +		    (param->max && (*param->max)*HZ < *valp))
>> +			return -EINVAL;
>>  	} else {
>>  		int val = *valp;
>>  		unsigned long lval;
>> @@ -3053,7 +3058,37 @@ int proc_dointvec_jiffies(struct ctl_table *table, int write,
>>  			  void __user *buffer, size_t *lenp, loff_t *ppos)
>>  {
>>      return do_proc_dointvec(table,write,buffer,lenp,ppos,
>> -		    	    do_proc_dointvec_jiffies_conv,NULL);
>> +			    do_proc_dointvec_jiffies_conv, NULL);
>> +}
>> +
>> +/**
>> + * proc_dointvec_jiffies_minmax - read a vector of integers as seconds with min/max values
>> + * @table: the sysctl table
>> + * @write: %TRUE if this is a write to the sysctl file
>> + * @buffer: the user buffer
>> + * @lenp: the size of the user buffer
>> + * @ppos: file position
>> + *
>> + * Reads/writes up to table->maxlen/sizeof(unsigned int) integer
>> + * values from/to the user buffer, treated as an ASCII string.
>> + * The values read are assumed to be in seconds, and are converted into
>> + * jiffies.
>> + *
>> + * This routine will ensure the values are within the range specified by
>> + * table->extra1 (min) and table->extra2 (max).
>> + *
>> + * Returns 0 on success or -EINVAL on write when the range check fails.
>> + */
>> +int proc_dointvec_jiffies_minmax(struct ctl_table *table, int write,
>> +			  void __user *buffer, size_t *lenp, loff_t *ppos)
>> +{
>> +	struct do_proc_dointvec_minmax_conv_param param = {
>> +		.min = (int *) table->extra1,
>> +		.max = (int *) table->extra2,
>> +	};
>> +
>> +	return do_proc_dointvec(table, write, buffer, lenp, ppos,
>> +				do_proc_dointvec_jiffies_conv, &param);
>>  }
>>
>>  /**
>> @@ -3301,6 +3336,12 @@ int proc_dointvec_jiffies(struct ctl_table *table, int write,
>>  	return -ENOSYS;
>>  }
>>
>> +int proc_dointvec_jiffies_minmax(struct ctl_table *table, int write,
>> +		    void __user *buffer, size_t *lenp, loff_t *ppos)
>> +{
>> +	return -ENOSYS;
>> +}
>> +
>>  int proc_dointvec_userhz_jiffies(struct ctl_table *table, int write,
>>  		    void __user *buffer, size_t *lenp, loff_t *ppos)
>>  {
>> @@ -3359,6 +3400,7 @@ static int proc_dointvec_minmax_bpf_stats(struct ctl_table *table, int write,
>>  EXPORT_SYMBOL(proc_dointvec);
>>  EXPORT_SYMBOL(proc_douintvec);
>>  EXPORT_SYMBOL(proc_dointvec_jiffies);
>> +EXPORT_SYMBOL(proc_dointvec_jiffies_minmax);
>>  EXPORT_SYMBOL(proc_dointvec_minmax);
>>  EXPORT_SYMBOL_GPL(proc_douintvec_minmax);
>>  EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
>>
> 
> 
> .
>