This is a note to let you know that I've just added the patch titled
proc: avoid integer type confusion in get_proc_long
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
proc-avoid-integer-type-confusion-in-get_proc_long.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From e6cfaf34be9fcd1a8285a294e18986bfc41a409c Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Date: Mon, 5 Dec 2022 11:33:40 -0800
Subject: proc: avoid integer type confusion in get_proc_long
From: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
commit e6cfaf34be9fcd1a8285a294e18986bfc41a409c upstream.
proc_get_long() is passed a size_t, but then assigns it to an 'int'
variable for the length. Let's not do that, even if our IO paths are
limited to MAX_RW_COUNT (exactly because of these kinds of type errors).
So do the proper test in the rigth type.
Reported-by: Kyle Zeng <zengyhkyle@xxxxxxxxx>
Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
kernel/sysctl.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2081,13 +2081,12 @@ static int proc_get_long(char **buf, siz
unsigned long *val, bool *neg,
const char *perm_tr, unsigned perm_tr_len, char *tr)
{
- int len;
char *p, tmp[TMPBUFLEN];
+ ssize_t len = *size;
- if (!*size)
+ if (len <= 0)
return -EINVAL;
- len = *size;
if (len > TMPBUFLEN - 1)
len = TMPBUFLEN - 1;
Patches currently in stable-queue which might be from torvalds@xxxxxxxxxxxxxxxxxxxx are
queue-4.9/proc-avoid-integer-type-confusion-in-get_proc_long.patch
queue-4.9/proc-proc_skip_spaces-shouldn-t-think-it-is-working-on-c-strings.patch
