Patch "sysctl: Fix out of bounds access for empty sysctl registers" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    sysctl: Fix out of bounds access for empty sysctl registers

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     sysctl-fix-out-of-bounds-access-for-empty-sysctl-reg.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5b0f7f2e4621464f71d7d51d845e427528740172
Author: Joel Granados <j.granados@xxxxxxxxxxx>
Date:   Tue Nov 21 12:02:18 2023 +0100

    sysctl: Fix out of bounds access for empty sysctl registers
    
    [ Upstream commit 315552310c7de92baea4e570967066569937a843 ]
    
    When registering tables to the sysctl subsystem there is a check to see
    if header is a permanently empty directory (used for mounts). This check
    evaluates the first element of the ctl_table. This results in an out of
    bounds evaluation when registering empty directories.
    
    The function register_sysctl_mount_point now passes a ctl_table of size
    1 instead of size 0. It now relies solely on the type to identify
    a permanently empty register.
    
    Make sure that the ctl_table has at least one element before testing for
    permanent emptiness.
    
    Signed-off-by: Joel Granados <j.granados@xxxxxxxxxxx>
    Reported-by: kernel test robot <oliver.sang@xxxxxxxxx>
    Closes: https://lore.kernel.org/oe-lkp/202311201431.57aae8f3-oliver.sang@xxxxxxxxx
    Signed-off-by: Luis Chamberlain <mcgrof@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index de484195f49f..5b5cdc747cef 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -44,7 +44,7 @@ static struct ctl_table sysctl_mount_point[] = {
  */
 struct ctl_table_header *register_sysctl_mount_point(const char *path)
 {
-	return register_sysctl_sz(path, sysctl_mount_point, 0);
+	return register_sysctl(path, sysctl_mount_point);
 }
 EXPORT_SYMBOL(register_sysctl_mount_point);
 
@@ -233,7 +233,8 @@ static int insert_header(struct ctl_dir *dir, struct ctl_table_header *header)
 		return -EROFS;
 
 	/* Am I creating a permanently empty directory? */
-	if (sysctl_is_perm_empty_ctl_table(header->ctl_table)) {
+	if (header->ctl_table_size > 0 &&
+	    sysctl_is_perm_empty_ctl_table(header->ctl_table)) {
 		if (!RB_EMPTY_ROOT(&dir->root))
 			return -EINVAL;
 		sysctl_set_perm_empty_ctl_header(dir_h);
@@ -1213,6 +1214,10 @@ static bool get_links(struct ctl_dir *dir,
 	struct ctl_table_header *tmp_head;
 	struct ctl_table *entry, *link;
 
+	if (header->ctl_table_size == 0 ||
+	    sysctl_is_perm_empty_ctl_table(header->ctl_table))
+		return true;
+
 	/* Are there links available for every entry in table? */
 	list_for_each_table_entry(entry, header) {
 		const char *procname = entry->procname;