diff options
| author |   Nicolas Bouchinet <nicolas.bouchinet@ssi.gouv.fr> | 2025-01-15 14:22:09 +0100 |
|---|---|---|
| committer |   Joel Granados <joel.granados@kernel.org> | 2025-02-17 11:33:46 +0100 |
| commit | a231f5bdfdd0ac402656d82ee7e6c54ec86c0c3b (patch) | |
| tree | 93209dec18e37ff1999229128e4790683d3d775a /arch/sh | |
| parent | coredump: Fixes core_pipe_limit sysctl proc_handler (diff) | |
| download | wireguard-linux-a231f5bdfdd0ac402656d82ee7e6c54ec86c0c3b.tar.xz wireguard-linux-a231f5bdfdd0ac402656d82ee7e6c54ec86c0c3b.zip | |
sysctl: Fix underflow value setting risk in vm_table
Commit 3b3376f222e3 ("sysctl.c: fix underflow value setting risk in vm_table")
fixes underflow value setting risk in vm_table but misses vdso_enabled
sysctl.
vdso_enabled sysctl is initialized with .extra1 value as SYSCTL_ZERO to
avoid negative value writes but the proc_handler is proc_dointvec and
not proc_dointvec_minmax and thus do not uses .extra1 and .extra2.
The following command thus works :
`# echo -1 > /proc/sys/vm/vdso_enabled`
This patch properly sets the proc_handler to proc_dointvec_minmax.
In addition to .extra1, .extra2 is set to SYSCTL_ONE. The sysctl is
thus bounded between 0 and 1.
Fixes: 3b3376f222e3 ("sysctl.c: fix underflow value setting risk in vm_table")
Signed-off-by: Nicolas Bouchinet <nicolas.bouchinet@ssi.gouv.fr>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Kees Cook <kees@kernel.org>
Signed-off-by: Joel Granados <joel.granados@kernel.org>
Diffstat (limited to 'arch/sh')
| -rw-r--r-- | arch/sh/kernel/vsyscall/vsyscall.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/arch/sh/kernel/vsyscall/vsyscall.c b/arch/sh/kernel/vsyscall/vsyscall.c index d80dd92a483a..1563dcc55fd3 100644 --- a/arch/sh/kernel/vsyscall/vsyscall.c +++ b/arch/sh/kernel/vsyscall/vsyscall.c @@ -37,8 +37,9 @@ static const struct ctl_table vdso_table[] = { .data = &vdso_enabled, .maxlen = sizeof(vdso_enabled), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_ONE, }, }; |