mult_hz() converts a user-supplied seconds value to jiffies for proc_dointvec_jiffies(). proc_int_u2k_conv_uop() rejects a result above INT_MAX, but it inspects the product, so a product that wraps arrives as a small value and is stored: # echo 18446744073709552 > /proc/sys/net/ipv4/tcp_keepalive_time # cat /proc/sys/net/ipv4/tcp_keepalive_time 0 One less is rejected; that value wraps to 384 jiffies at HZ=1000. 65 sysctls use proc_dointvec_jiffies(), among them tcp_keepalive_time, tcp_fin_timeout and the conntrack timeouts. Bound the input in the shape clock_t_to_jiffies() already uses and leave the INT_MAX policy to the caller. The bound was open-coded as "*lvalp > INT_MAX / HZ" until commit 2dc164a48e6f ("sysctl: Create converter functions with two new macros"). Fixes: 2dc164a48e6f ("sysctl: Create converter functions with two new macros") Cc: stable@vger.kernel.org Signed-off-by: Zhan Xusheng --- kernel/time/jiffies.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c index 80c354811538..9b3487d40cd6 100644 --- a/kernel/time/jiffies.c +++ b/kernel/time/jiffies.c @@ -101,6 +101,8 @@ void __init register_refined_jiffies(long cycles_per_second) #ifdef CONFIG_SYSCTL static ulong mult_hz(const ulong val) { + if (val >= ULONG_MAX / HZ) + return ULONG_MAX; return val * HZ; } -- 2.43.0