Since the cited commit changed proc_doulongvec_ms_jiffies_minmax() to use proc_ulong_conv(), proc_doulongvec_ms_jiffies_minmax() no longer applies the range check. It happened probably because do_proc_ulong_conv_ms_jiffies() does not have the _minmax suffix. In addition, sysctl_msecs_to_jiffies() casts u64 user input to u32, and a truncated value could bypass the max check. Let's rename do_proc_ulong_conv_ms_jiffies(), pass true to k_ptr_range_check, and limit the max user input to INT_MAX in sysctl_u2k_ulong_conv_ms() to avoid truncation and clamping to MAX_JIFFY_OFFSET. (INT_MAX ms ~= 24 days is more than enough) Fixes: b96b5c6708ea ("sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec") Signed-off-by: Kuniyuki Iwashima --- kernel/time/jiffies.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c index 70926b73905a..4737431fdb16 100644 --- a/kernel/time/jiffies.c +++ b/kernel/time/jiffies.c @@ -187,6 +187,9 @@ static int do_proc_int_conv_ms_jiffies_minmax(bool *negp, ulong *u_ptr, static int sysctl_u2k_ulong_conv_ms(const ulong *u_ptr, ulong *k_ptr) { + if (*u_ptr > INT_MAX) + return -EINVAL; + return proc_ulong_u2k_conv_uop(u_ptr, k_ptr, sysctl_msecs_to_jiffies); } @@ -195,10 +198,10 @@ static int sysctl_k2u_ulong_conv_ms(ulong *u_ptr, const ulong *k_ptr) return proc_ulong_k2u_conv_kop(u_ptr, k_ptr, sysctl_jiffies_to_msecs); } -static int do_proc_ulong_conv_ms_jiffies(bool *negp, ulong *u_ptr, ulong *k_ptr, - int dir, const struct ctl_table *tbl) +static int do_proc_ulong_conv_ms_jiffies_minmax(bool *negp, ulong *u_ptr, ulong *k_ptr, + int dir, const struct ctl_table *tbl) { - return proc_ulong_conv(u_ptr, k_ptr, dir, tbl, false, + return proc_ulong_conv(u_ptr, k_ptr, dir, tbl, true, sysctl_u2k_ulong_conv_ms, sysctl_k2u_ulong_conv_ms); } @@ -229,8 +232,8 @@ static int do_proc_int_conv_ms_jiffies_minmax(bool *negp, ulong *u_ptr, return -ENOSYS; } -static int do_proc_ulong_conv_ms_jiffies(bool *negp, ulong *u_ptr, ulong *k_ptr, - int dir, const struct ctl_table *tbl) +static int do_proc_ulong_conv_ms_jiffies_minmax(bool *negp, ulong *u_ptr, ulong *k_ptr, + int dir, const struct ctl_table *tbl) { return -ENOSYS; } @@ -333,7 +336,7 @@ int proc_doulongvec_ms_jiffies_minmax(const struct ctl_table *table, int dir, void *buffer, size_t *lenp, loff_t *ppos) { return proc_doulongvec_conv(table, dir, buffer, lenp, ppos, - do_proc_ulong_conv_ms_jiffies); + do_proc_ulong_conv_ms_jiffies_minmax); } EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax); -- 2.55.0.1003.g10538fe699-goog