Messages in this thread | | | From | Kees Cook <> | Date | Tue, 14 Jun 2016 11:33:55 -0700 | Subject | Re: [PATCH 1/1] kernel/sysctl.c: avoid overflow |
| |
On Fri, Jun 10, 2016 at 6:33 PM, Heinrich Schuchardt <xypron.glpk@gmx.de> wrote: > An undetected overflow may occur in do_proc_dointvec_minmax_conv_param. > > Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Acked-by: Kees Cook <keescook@chromium.org>
Thanks for the fix!
-Kees
> --- > kernel/sysctl.c | 12 +++++++++++- > 1 file changed, 11 insertions(+), 1 deletion(-) > > diff --git a/kernel/sysctl.c b/kernel/sysctl.c > index 35f0dcb..a9e7be3 100644 > --- a/kernel/sysctl.c > +++ b/kernel/sysctl.c > @@ -2313,7 +2313,17 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp, > { > struct do_proc_dointvec_minmax_conv_param *param = data; > if (write) { > - int val = *negp ? -*lvalp : *lvalp; > + int val; > + > + if (*negp) { > + if (*lvalp > (unsigned long) INT_MAX + 1) > + return -EINVAL; > + val = -*lvalp; > + } else { > + if (*lvalp > (unsigned long) INT_MAX) > + return -EINVAL; > + val = *lvalp; > + } > if ((param->min && *param->min > val) || > (param->max && *param->max < val)) > return -EINVAL; > -- > 2.1.4 >
-- Kees Cook Chrome OS & Brillo Security
| |