The patch titled
Subject: kernel/sysctl.c: add flags to support min/max range clamping
has been added to the -mm tree. Its filename is
sysctl-add-flags-to-support-min-max-range-clamping.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/sysctl-add-flags-to-support-min-max-range-clamping.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/sysctl-add-flags-to-support-min-max-range-clamping.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Waiman Long <longman@xxxxxxxxxx>
Subject: kernel/sysctl.c: add flags to support min/max range clamping
Patch series "pc: Clamp *mni to the real IPCMNI limit", v4.
The sysctl parameters msgmni, shmmni and semmni have an inherent limit of
IPC_MNI (32k). However, users may not be aware of that because they can
write a value much higher than that without getting any error or
notification. Reading the parameters back will show the newly written
values which are not real.
Enforcing the limit by failing sysctl parameter write, however, can break
existing user applications. To address this delemma, a new flags field is
introduced into the ctl_table. The value CTL_FLAGS_CLAMP_RANGE can be
added to any ctl_table entries to enable a looser range clamping without
returning any error. For example,
.flags = CTL_FLAGS_CLAMP_RANGE,
This flags value are now used for the range checking of shmmni, msgmni and
semmni without breaking existing applications. If any out of range value
is written to those sysctl parameters, the following warning will be
printed instead.
sysctl: "shmmni" was set out of range [0, 32768], clamped to 32768.
Reading the values back will show 32768 instead of some fake values.
This patch (of 6):
When minimum/maximum values are specified for a sysctl parameter in the
ctl_table structure with proc_dointvec_minmax() handler, update to that
parameter will fail with error if the given value is outside of the
required range.
There are use cases where it may be better to clamp the value of the
sysctl parameter to the given range without failing the update, especially
if the users are not aware of the actual range limits. Reading the value
back after the update will now be a good practice to see if the provided
value exceeds the range limits.
To provide this less restrictive form of range checking, a new flags field
is added to the ctl_table structure.
When the CTL_FLAGS_CLAMP_RANGE flag is set in the ctl_table entry, any
update from the userspace will be clamped to the given range without error
if either the proc_dointvec_minmax() or the proc_douintvec_minmax()
handlers is used.
Link: http://lkml.kernel.org/r/1520885744-1546-2-git-send-email-longman@xxxxxxxxxx
Signed-off-by: Waiman Long <longman@xxxxxxxxxx>
Reviewed-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Cc: "Luis R. Rodriguez" <mcgrof@xxxxxxxxxx>
Cc: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Cc: Matthew Wilcox <willy@xxxxxxxxxxxxx>
Cc: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
Cc: Alexey Dobriyan <adobriyan@xxxxxxxxx>
Cc: Davidlohr Bueso <dave@xxxxxxxxxxxx>
Cc: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
include/linux/sysctl.h | 15 ++++++++++++
kernel/sysctl.c | 48 +++++++++++++++++++++++++++++++--------
2 files changed, 54 insertions(+), 9 deletions(-)
diff -puN include/linux/sysctl.h~sysctl-add-flags-to-support-min-max-range-clamping include/linux/sysctl.h
--- a/include/linux/sysctl.h~sysctl-add-flags-to-support-min-max-range-clamping
+++ a/include/linux/sysctl.h
@@ -116,6 +116,7 @@ struct ctl_table
void *data;
int maxlen;
umode_t mode;
+ unsigned int flags;
struct ctl_table *child; /* Deprecated */
proc_handler *proc_handler; /* Callback for text formatting */
struct ctl_table_poll *poll;
@@ -123,6 +124,20 @@ struct ctl_table
void *extra2;
} __randomize_layout;
+/**
+ * enum ctl_table_flags - flags for the ctl table (struct ctl_table.flags)
+ *
+ * @CTL_FLAGS_CLAMP_RANGE: Set to indicate that the entry should be
+ * flexibly clamped to min/max range in case the user provided
+ * an incorrect value.
+ */
+enum ctl_table_flags {
+ CTL_FLAGS_CLAMP_RANGE = BIT(0),
+ __CTL_FLAGS_MAX = BIT(1),
+};
+
+#define CTL_TABLE_FLAGS_ALL (__CTL_FLAGS_MAX - 1)
+
struct ctl_node {
struct rb_node node;
struct ctl_table_header *header;
diff -puN kernel/sysctl.c~sysctl-add-flags-to-support-min-max-range-clamping kernel/sysctl.c
--- a/kernel/sysctl.c~sysctl-add-flags-to-support-min-max-range-clamping
+++ a/kernel/sysctl.c
@@ -2504,6 +2504,7 @@ static int proc_dointvec_minmax_sysadmin
* struct do_proc_dointvec_minmax_conv_param - proc_dointvec_minmax() range checking structure
* @min: pointer to minimum allowable value
* @max: pointer to maximum allowable value
+ * @flags: pointer to flags
*
* The do_proc_dointvec_minmax_conv_param structure provides the
* minimum and maximum values for doing range checking for those sysctl
@@ -2512,6 +2513,7 @@ static int proc_dointvec_minmax_sysadmin
struct do_proc_dointvec_minmax_conv_param {
int *min;
int *max;
+ unsigned int *flags;
};
static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp,
@@ -2521,9 +2523,21 @@ static int do_proc_dointvec_minmax_conv(
struct do_proc_dointvec_minmax_conv_param *param = data;
if (write) {
int val = *negp ? -*lvalp : *lvalp;
- if ((param->min && *param->min > val) ||
- (param->max && *param->max < val))
- return -EINVAL;
+ bool clamp = param->flags &&
+ (*param->flags & CTL_FLAGS_CLAMP_RANGE);
+
+ if (param->min && *param->min > val) {
+ if (clamp)
+ val = *param->min;
+ else
+ return -EINVAL;
+ }
+ if (param->max && *param->max < val) {
+ if (clamp)
+ val = *param->max;
+ else
+ return -EINVAL;
+ }
*valp = val;
} else {
int val = *valp;
@@ -2552,7 +2566,8 @@ static int do_proc_dointvec_minmax_conv(
* This routine will ensure the values are within the range specified by
* table->extra1 (min) and table->extra2 (max).
*
- * Returns 0 on success or -EINVAL on write when the range check fails.
+ * Returns 0 on success or -EINVAL on write when the range check fails
+ * without the CTL_FLAGS_CLAMP_RANGE flag.
*/
int proc_dointvec_minmax(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
@@ -2560,6 +2575,7 @@ int proc_dointvec_minmax(struct ctl_tabl
struct do_proc_dointvec_minmax_conv_param param = {
.min = (int *) table->extra1,
.max = (int *) table->extra2,
+ .flags = &table->flags,
};
return do_proc_dointvec(table, write, buffer, lenp, ppos,
do_proc_dointvec_minmax_conv, ¶m);
@@ -2569,6 +2585,7 @@ int proc_dointvec_minmax(struct ctl_tabl
* struct do_proc_douintvec_minmax_conv_param - proc_douintvec_minmax() range checking structure
* @min: pointer to minimum allowable value
* @max: pointer to maximum allowable value
+ * @flags: pointer to flags
*
* The do_proc_douintvec_minmax_conv_param structure provides the
* minimum and maximum values for doing range checking for those sysctl
@@ -2577,6 +2594,7 @@ int proc_dointvec_minmax(struct ctl_tabl
struct do_proc_douintvec_minmax_conv_param {
unsigned int *min;
unsigned int *max;
+ unsigned int *flags;
};
static int do_proc_douintvec_minmax_conv(unsigned long *lvalp,
@@ -2587,14 +2605,24 @@ static int do_proc_douintvec_minmax_conv
if (write) {
unsigned int val = *lvalp;
+ bool clamp = param->flags &&
+ (*param->flags & CTL_FLAGS_CLAMP_RANGE);
if (*lvalp > UINT_MAX)
return -EINVAL;
- if ((param->min && *param->min > val) ||
- (param->max && *param->max < val))
- return -ERANGE;
-
+ if (param->min && *param->min > val) {
+ if (clamp)
+ val = *param->min;
+ else
+ return -ERANGE;
+ }
+ if (param->max && *param->max < val) {
+ if (clamp)
+ val = *param->max;
+ else
+ return -ERANGE;
+ }
*valp = val;
} else {
unsigned int val = *valp;
@@ -2621,7 +2649,8 @@ static int do_proc_douintvec_minmax_conv
* check for UINT_MAX to avoid having to support wrap around uses from
* userspace.
*
- * Returns 0 on success or -ERANGE on write when the range check fails.
+ * Returns 0 on success or -ERANGE on write when the range check fails
+ * without the CTL_FLAGS_CLAMP_RANGE flag.
*/
int proc_douintvec_minmax(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
@@ -2629,6 +2658,7 @@ int proc_douintvec_minmax(struct ctl_tab
struct do_proc_douintvec_minmax_conv_param param = {
.min = (unsigned int *) table->extra1,
.max = (unsigned int *) table->extra2,
+ .flags = &table->flags,
};
return do_proc_douintvec(table, write, buffer, lenp, ppos,
do_proc_douintvec_minmax_conv, ¶m);
_
Patches currently in -mm which might be from longman@xxxxxxxxxx are
list_lru-prefetch-neighboring-list-entries-before-acquiring-lock.patch
proc-sysctl-fix-typo-in-sysctl_check_table_array.patch
sysctl-add-kdoc-comments-to-do_proc_douintvec_minmax_conv_param.patch
sysctl-add-flags-to-support-min-max-range-clamping.patch
proc-sysctl-check-for-invalid-flags-bits.patch
sysctl-warn-when-a-clamped-sysctl-parameter-is-set-out-of-range.patch
ipc-clamp-msgmni-and-shmmni-to-the-real-ipcmni-limit.patch
ipc-clamp-semmni-to-the-real-ipcmni-limit.patch
test_sysctl-add-range-clamping-test.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
