Commit 3b3376f2 authored by Lin Feng's avatar Lin Feng Committed by Linus Torvalds
Browse files

sysctl.c: fix underflow value setting risk in vm_table 

Apart from subsystem specific .proc_handler handler, all ctl_tables with
extra1 and extra2 members set should use proc_dointvec_minmax instead of
proc_dointvec, or the limit set in extra* never work and potentially echo
underflow values(negative numbers) is likely make system unstable.

Especially vfs_cache_pressure and zone_reclaim_mode, -1 is apparently not
a valid value, but we can set to them.  And then kernel may crash.

# echo -1 > /proc/sys/vm/vfs_cache_pressure

Link: https://lkml.kernel.org/r/20201223105535.2875-1-linf@wangsu.com


Signed-off-by: default avatarLin Feng <linf@wangsu.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 45089437

kernel/sysctl.c

+4 −4
Original line number Diff line number Diff line
@@ -2962,7 +2962,7 @@ static struct ctl_table vm_table[] = { 
		.data		= &block_dump,

		.maxlen		= sizeof(block_dump),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ZERO,

	},

	{
@@ -2970,7 +2970,7 @@ static struct ctl_table vm_table[] = { 
		.data		= &sysctl_vfs_cache_pressure,

		.maxlen		= sizeof(sysctl_vfs_cache_pressure),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ZERO,

	},

#if defined(HAVE_ARCH_PICK_MMAP_LAYOUT) || \
@@ -2980,7 +2980,7 @@ static struct ctl_table vm_table[] = { 
		.data		= &sysctl_legacy_va_layout,

		.maxlen		= sizeof(sysctl_legacy_va_layout),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ZERO,

	},

#endif
@@ -2990,7 +2990,7 @@ static struct ctl_table vm_table[] = { 
		.data		= &node_reclaim_mode,

		.maxlen		= sizeof(node_reclaim_mode),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ZERO,

	},

	{