From: Nicolas Bouchinet Date: Wed, 15 Jan 2025 13:22:09 +0000 (+0100) Subject: sysctl: Fix underflow value setting risk in vm_table X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=a231f5bdfdd0ac402656d82ee7e6c54ec86c0c3b;p=users%2Fdwmw2%2Flinux.git sysctl: Fix underflow value setting risk in vm_table Commit 3b3376f222e3 ("sysctl.c: fix underflow value setting risk in vm_table") fixes underflow value setting risk in vm_table but misses vdso_enabled sysctl. vdso_enabled sysctl is initialized with .extra1 value as SYSCTL_ZERO to avoid negative value writes but the proc_handler is proc_dointvec and not proc_dointvec_minmax and thus do not uses .extra1 and .extra2. The following command thus works : `# echo -1 > /proc/sys/vm/vdso_enabled` This patch properly sets the proc_handler to proc_dointvec_minmax. In addition to .extra1, .extra2 is set to SYSCTL_ONE. The sysctl is thus bounded between 0 and 1. Fixes: 3b3376f222e3 ("sysctl.c: fix underflow value setting risk in vm_table") Signed-off-by: Nicolas Bouchinet Reviewed-by: Jan Kara Reviewed-by: Kees Cook Signed-off-by: Joel Granados --- diff --git a/arch/sh/kernel/vsyscall/vsyscall.c b/arch/sh/kernel/vsyscall/vsyscall.c index d80dd92a483af..1563dcc55fd32 100644 --- a/arch/sh/kernel/vsyscall/vsyscall.c +++ b/arch/sh/kernel/vsyscall/vsyscall.c @@ -37,8 +37,9 @@ static const struct ctl_table vdso_table[] = { .data = &vdso_enabled, .maxlen = sizeof(vdso_enabled), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_ONE, }, };