On Fri, Apr 17, 2020 at 08:41:46AM +0200, Christoph Hellwig wrote: > diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c > index b6f5d459b087..d5c9a9bf4e90 100644 > --- a/fs/proc/proc_sysctl.c > +++ b/fs/proc/proc_sysctl.c > @@ -539,13 +539,13 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry, > return err; > } > > -static ssize_t proc_sys_call_handler(struct file *filp, void __user *buf, > +static ssize_t proc_sys_call_handler(struct file *filp, void __user *ubuf, > size_t count, loff_t *ppos, int write) > { > struct inode *inode = file_inode(filp); > struct ctl_table_header *head = grab_header(inode); > struct ctl_table *table = PROC_I(inode)->sysctl_entry; > - void *new_buf = NULL; > + void *kbuf; > ssize_t error; > > if (IS_ERR(head)) > @@ -564,27 +564,36 @@ static ssize_t proc_sys_call_handler(struct file *filp, void __user *buf, > if (!table->proc_handler) > goto out; > > - error = BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, buf, &count, > - ppos, &new_buf); > + if (write) { > + kbuf = memdup_user_nul(ubuf, count); > + if (IS_ERR(kbuf)) { > + error = PTR_ERR(kbuf); > + goto out; > + } > + } else { > + error = -ENOMEM; > + kbuf = kzalloc(count, GFP_KERNEL); > + if (!kbuf) > + goto out; > + } > + > + error = BPF_CGROUP_RUN_PROG_SYSCTL(head, table, write, &kbuf, &count, > + ppos); > if (error) > - goto out; > + goto out_free_buf; > > /* careful: calling conventions are nasty here */ I think this comment can go now ;-) > - if (new_buf) { > - mm_segment_t old_fs; > - > - old_fs = get_fs(); > - set_fs(KERNEL_DS); > - error = table->proc_handler(table, write, (void __user *)new_buf, > - &count, ppos); > - set_fs(old_fs); > - kfree(new_buf); > - } else { > - error = table->proc_handler(table, write, buf, &count, ppos); > - } > + error = table->proc_handler(table, write, kbuf, &count, ppos); > + if (error) > + goto out_free_buf; > + > + error = -EFAULT; > + if (copy_to_user(ubuf, kbuf, count)) > + goto out_free_buf; Can we skip this if !write? Indeed, don't we have to in case the user has passed a pointer to a read-only memory page?