The second one is to declare .extra1 or .extra2 values with a .proc_handler that don't uses them. i.e, declaring .extra1 or .extra2 using proc_dointvec in order to declare conversion bounds do not work as do_proc_dointvec don't uses those variables if not explicitly asked. This patchset corrects three sysctl declaration that are buggy as an example and is not exhaustive. This patch (of 2): proc_dointvec converts a string to a vector of signed int, which is stored in the unsigned int .data core_pipe_limit. It was thus authorized to write a negative value to core_pipe_limit sysctl which once stored in core_pipe_limit, leads to the signed int dump_count check against core_pipe_limit never be true. The same can be achieved with core_pipe_limit set to INT_MAX. Any negative write or >= to INT_MAX in core_pipe_limit sysctl would hypothetically allow a user to create very high load on the system by running processes that produces a coredump in case the core_pattern sysctl is configured to pipe core files to user space helper. Memory or PID exhaustion should happen before but it anyway breaks the core_pipe_limit semantic. This commit fixes this by changing core_pipe_limit sysctl's proc_handler to proc_dointvec_minmax and bound checking between SYSCTL_ZERO and SYSCTL_INT_MAX. Link: https://lkml.kernel.org/r/20250115132211.25400-1-nicolas.bouchinet@xxxxxxxxxxx Link: https://lkml.kernel.org/r/20250115132211.25400-2-nicolas.bouchinet@xxxxxxxxxxx Fixes: a293980c2e26 ("exec: let do_coredump() limit the number of concurrent dumps to pipes") Signed-off-by: Nicolas Bouchinet <nicolas.bouchinet@xxxxxxxxxxx> Reviewed-by: Jan Kara <jack@xxxxxxx> Reviewed-by: Kees Cook <kees@xxxxxxxxxx> Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: Christian Brauner <brauner@xxxxxxxxxx> Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Cc: Jiri Slaby <jirislaby@xxxxxxxxxx> Cc: Joel Granados <j.granados@xxxxxxxxxxx> Cc: Lin Feng <linf@xxxxxxxxxx> Cc: Luis Chamberalin <mcgrof@xxxxxxxxxx> Cc: "Neil Horman" <nhorman@xxxxxxxxxxxxx> Cc: Ted Ts'o <tytso@xxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/coredump.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/fs/coredump.c~coredump-fixes-core_pipe_limit-sysctl-proc_handler +++ a/fs/coredump.c @@ -1015,7 +1015,9 @@ static struct ctl_table coredump_sysctls .data = &core_pipe_limit, .maxlen = sizeof(unsigned int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_INT_MAX, }, { .procname = "core_file_note_size_limit", _ Patches currently in -mm which might be from nicolas.bouchinet@xxxxxxxxxxx are coredump-fixes-core_pipe_limit-sysctl-proc_handler.patch sysctl-fix-underflow-value-setting-risk-in-vm_table.patch
