Skip to contentSkip to conversation

Fix overflow errors in /proc/sys/net/ipv4/neigh/

PATCH Applied Francesco Fusco 3 participants 6 messages Jul 24, 2013 – Jul 26, 2013

Subsystems (3)
Networking Network drivers Proc sysctl

v1 of 2 Applied Latest is v2 →

lore
Share & tools
lore

Francesco Fusco

author
#0 lore raw

cover Fix overflow errors in /proc/sys/net/ipv4/neigh/

These two patches fix possible overflow errors in /proc/sys/net/ipv4/neigh/.

Francesco Fusco (2):
neigh: prevent overflowing params in /proc/sys/net/ipv4/neigh/
sysctl: range checking in do_proc_dointvec_ms_jiffies_conv

 kernel/sysctl.c      |  6 +++++-
 net/core/neighbour.c | 29 ++++++++++++++++++++++-------
 2 files changed, 27 insertions(+), 8 deletions(-)
Signature · 1 line
1.8.3.1
author
#1 lore raw

PATCH 1/2 neigh: prevent overflowing params in /proc/sys/net/ipv4/neigh/

Without this patch, the fields app_solicit, gc_thresh1, gc_thresh2, gc_thresh3, proxy_qlen, ucast_solicit, mcast_solicit could have assumed negative values when setting large numbers.

Signed-off-by Francesco Fusco <[email protected]>
---
 net/core/neighbour.c | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)
net/core/neighbour.c +22 -7
index b7de821..9232c68 100644
@@ -2767,6 +2767,7 @@ EXPORT_SYMBOL(neigh_app_ns);
 
 #ifdef CONFIG_SYSCTL
 static int zero;
+static int int_max = INT_MAX;
 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
 
 static int proc_unres_qlen(struct ctl_table *ctl, int write,

@@ -2819,19 +2820,25 @@ static struct neigh_sysctl_table {
 			.procname	= "mcast_solicit",
 			.maxlen		= sizeof(int),
 			.mode		= 0644,
-			.proc_handler	= proc_dointvec,
+			.extra1 	= &zero,
+			.extra2		= &int_max,
+			.proc_handler	= proc_dointvec_minmax,
 		},
 		[NEIGH_VAR_UCAST_PROBE] = {
 			.procname	= "ucast_solicit",
 			.maxlen		= sizeof(int),
 			.mode		= 0644,
-			.proc_handler	= proc_dointvec,
+			.extra1 	= &zero,
+			.extra2		= &int_max,
+			.proc_handler	= proc_dointvec_minmax,
 		},
 		[NEIGH_VAR_APP_PROBE] = {
 			.procname	= "app_solicit",
 			.maxlen		= sizeof(int),
 			.mode		= 0644,
-			.proc_handler	= proc_dointvec,
+			.extra1 	= &zero,
+			.extra2		= &int_max,
+			.proc_handler	= proc_dointvec_minmax,
 		},
 		[NEIGH_VAR_RETRANS_TIME] = {
 			.procname	= "retrans_time",

@@ -2874,7 +2881,9 @@ static struct neigh_sysctl_table {
 			.procname	= "proxy_qlen",
 			.maxlen		= sizeof(int),
 			.mode		= 0644,
-			.proc_handler	= proc_dointvec,
+			.extra1 	= &zero,
+			.extra2		= &int_max,
+			.proc_handler	= proc_dointvec_minmax,
 		},
 		[NEIGH_VAR_ANYCAST_DELAY] = {
 			.procname	= "anycast_delay",

@@ -2916,19 +2925,25 @@ static struct neigh_sysctl_table {
 			.procname	= "gc_thresh1",
 			.maxlen		= sizeof(int),
 			.mode		= 0644,
-			.proc_handler	= proc_dointvec,
+			.extra1 	= &zero,
+			.extra2		= &int_max,
+			.proc_handler	= proc_dointvec_minmax,
 		},
 		[NEIGH_VAR_GC_THRESH2] = {
 			.procname	= "gc_thresh2",
 			.maxlen		= sizeof(int),
 			.mode		= 0644,
-			.proc_handler	= proc_dointvec,
+			.extra1 	= &zero,
+			.extra2		= &int_max,
+			.proc_handler	= proc_dointvec_minmax,
 		},
 		[NEIGH_VAR_GC_THRESH3] = {
 			.procname	= "gc_thresh3",
 			.maxlen		= sizeof(int),
 			.mode		= 0644,
-			.proc_handler	= proc_dointvec,
+			.extra1 	= &zero,
+			.extra2		= &int_max,
+			.proc_handler	= proc_dointvec_minmax,
 		},
 		{},
 	},
Signature · 1 line
1.8.3.1
maintainer Applied
#2 lore raw

Re: [PATCH net-next 1/2] neigh: prevent overflowing params in /proc/sys/net/ipv4/neigh/

From: Francesco Fusco <[email protected]>
Date: Wed, 24 Jul 2013 10:39:06 +0200

Quoted 5 lines

Without this patch, the fields app_solicit, gc_thresh1, gc_thresh2, gc_thresh3, proxy_qlen, ucast_solicit, mcast_solicit could have assumed negative values when setting large numbers.

Signed-off-by Francesco Fusco <[email protected]>

Applied.

author
#3 lore raw

PATCH 2/2 sysctl: range checking in do_proc_dointvec_ms_jiffies_conv

In reply to Francesco Fusco

When (integer) sysctl values are expressed in ms and have to be represented internally as jiffies. The msecs_to_jiffies function returns an unsigned long, which gets assigned to the integer. This patch prevents the value to be assigned if bigger than INT_MAX, done in a similar way as in cba9f3 ("Range checking in do_proc_dointvec_(userhz_)jiffies_conv").

Signed-off-by Francesco Fusco <[email protected]>
CC Andrew Morton <[email protected]>
CC [email protected]
---
 kernel/sysctl.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/sysctl.c +5 -1
index ac09d98..00813e5 100644
@@ -2346,7 +2346,11 @@ static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp,
 					    int write, void *data)
 {
 	if (write) {
-		*valp = msecs_to_jiffies(*negp ? -*lvalp : *lvalp);
+		unsigned long jif = 0;
+		jif =  msecs_to_jiffies(*negp ? -*lvalp : *lvalp);
+		if (jif > INT_MAX)
+			return 1;
+		*valp = (int)jif;
 	} else {
 		int val = *valp;
 		unsigned long lval;
Signature · 1 line
1.8.3.1
#4 lore raw

Re: [PATCH net-next 2/2] sysctl: range checking in do_proc_dointvec_ms_jiffies_conv

Hello.

Quoted 19 lines · Francesco Fusco

When (integer) sysctl values are expressed in ms and have to be represented internally as jiffies. The msecs_to_jiffies function returns an unsigned long, which gets assigned to the integer. This patch prevents the value to be assigned if bigger than INT_MAX, done in a similar way as in cba9f3 ("Range checking in do_proc_dointvec_(userhz_)jiffies_conv").

Signed-off-by Francesco Fusco <[email protected]>
CC Andrew Morton <[email protected]>
CC [email protected]
---
  kernel/sysctl.c | 6 +++++-
  1 file changed, 5 insertions(+), 1 deletion(-)
kernel/sysctl.c +0 -0
index ac09d98..00813e5 100644

kernel/sysctl.c static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp, · line 2349

Quoted 5 lines
kernel/sysctl.c +1 -1
@@ -2346,7 +2346,11 @@ static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp,
  					    int write, void *data)
  {
  	if (write) {
-		*valp = msecs_to_jiffies(*negp ? -*lvalp : *lvalp);
+		unsigned long jif = 0;

Pointless initializer. And an empty line wouldn't hurt after declaration.

kernel/sysctl.c static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp, · line 2350

Quoted 1 line
kernel/sysctl.c +1 -0
+		jif =  msecs_to_jiffies(*negp ? -*lvalp : *lvalp);

One space after = is enough.

kernel/sysctl.c static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp, · line 2353

Quoted 3 lines
kernel/sysctl.c +3 -0
+		if (jif > INT_MAX)
+			return 1;
+		*valp = (int)jif;

WBR, Sergei

maintainer
#5 lore raw

Re: [PATCH net-next 2/2] sysctl: range checking in do_proc_dointvec_ms_jiffies_conv

In reply to Francesco Fusco

From: Francesco Fusco <[email protected]>
Date: Wed, 24 Jul 2013 10:39:07 +0200

Quoted 8 lines

When (integer) sysctl values are expressed in ms and have to be represented internally as jiffies. The msecs_to_jiffies function returns an unsigned long, which gets assigned to the integer. This patch prevents the value to be assigned if bigger than INT_MAX, done in a similar way as in cba9f3 ("Range checking in do_proc_dointvec_(userhz_)jiffies_conv").

Signed-off-by Francesco Fusco <[email protected]>

Applied with the changes suggested by Sergei.