When (integer) sysctl values are in either seconds or centiseconds, but represented internally as jiffies, the allowable value range is decreased. This patch adds range checks to the conversion routines. For values in seconds: maximum LONG_MAX / HZ. For values in centiseconds: maximum (LONG_MAX / HZ) * USER_HZ. (BTW, does anyone else feel that an interface in seconds should not be accepting negative values?)
Unified · Split
| @@ -2053,6 +2053,8 @@ static int do_proc_dointvec_jiffies_conv(int *negp, unsigned long *lvalp, · 2052 unmodified lines | |||
| 2053 | int write, void *data) | 2053 | int write, void *data) |
| 2054 | { | 2054 | { |
| 2055 | if (write) { | 2055 | if (write) { |
| 2056 | if (*lvalp > LONG_MAX / HZ) | ||
| 2057 | return 1; | ||
| 2056 | *valp = *negp ? -(*lvalp*HZ) : (*lvalp*HZ); | 2058 | *valp = *negp ? -(*lvalp*HZ) : (*lvalp*HZ); |
| 2057 | } else { | 2059 | } else { |
| 2058 | int val = *valp; | 2060 | int val = *valp; |
| @@ -2074,6 +2076,8 @@ static int do_proc_dointvec_userhz_jiffies_conv(int *negp, unsigned long *lvalp, · 15 unmodified lines | |||
| 2074 | int write, void *data) | 2076 | int write, void *data) |
| 2075 | { | 2077 | { |
| 2076 | if (write) { | 2078 | if (write) { |
| 2079 | if (USER_HZ < HZ && *lvalp > (LONG_MAX / HZ) * USER_HZ) | ||
| 2080 | return 1; | ||
| 2077 | *valp = clock_t_to_jiffies(*negp ? -*lvalp : *lvalp); | 2081 | *valp = clock_t_to_jiffies(*negp ? -*lvalp : *lvalp); |
| 2078 | } else { | 2082 | } else { |
| 2079 | int val = *valp; | 2083 | int val = *valp; |