Skip to content

Commit 3b3376f

Browse files
linfeng2999torvalds
authored andcommitted
sysctl.c: fix underflow value setting risk in vm_table
Apart from subsystem specific .proc_handler handler, all ctl_tables with extra1 and extra2 members set should use proc_dointvec_minmax instead of proc_dointvec, or the limit set in extra* never work and potentially echo underflow values(negative numbers) is likely make system unstable. Especially vfs_cache_pressure and zone_reclaim_mode, -1 is apparently not a valid value, but we can set to them. And then kernel may crash. # echo -1 > /proc/sys/vm/vfs_cache_pressure Link: https://lkml.kernel.org/r/20201223105535.2875-1-linf@wangsu.com Signed-off-by: Lin Feng <linf@wangsu.com> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 4508943 commit 3b3376f

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

kernel/sysctl.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2962,15 +2962,15 @@ static struct ctl_table vm_table[] = {
29622962
.data = &block_dump,
29632963
.maxlen = sizeof(block_dump),
29642964
.mode = 0644,
2965-
.proc_handler = proc_dointvec,
2965+
.proc_handler = proc_dointvec_minmax,
29662966
.extra1 = SYSCTL_ZERO,
29672967
},
29682968
{
29692969
.procname = "vfs_cache_pressure",
29702970
.data = &sysctl_vfs_cache_pressure,
29712971
.maxlen = sizeof(sysctl_vfs_cache_pressure),
29722972
.mode = 0644,
2973-
.proc_handler = proc_dointvec,
2973+
.proc_handler = proc_dointvec_minmax,
29742974
.extra1 = SYSCTL_ZERO,
29752975
},
29762976
#if defined(HAVE_ARCH_PICK_MMAP_LAYOUT) || \
@@ -2980,7 +2980,7 @@ static struct ctl_table vm_table[] = {
29802980
.data = &sysctl_legacy_va_layout,
29812981
.maxlen = sizeof(sysctl_legacy_va_layout),
29822982
.mode = 0644,
2983-
.proc_handler = proc_dointvec,
2983+
.proc_handler = proc_dointvec_minmax,
29842984
.extra1 = SYSCTL_ZERO,
29852985
},
29862986
#endif
@@ -2990,7 +2990,7 @@ static struct ctl_table vm_table[] = {
29902990
.data = &node_reclaim_mode,
29912991
.maxlen = sizeof(node_reclaim_mode),
29922992
.mode = 0644,
2993-
.proc_handler = proc_dointvec,
2993+
.proc_handler = proc_dointvec_minmax,
29942994
.extra1 = SYSCTL_ZERO,
29952995
},
29962996
{

0 commit comments

Comments
 (0)