Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-26 06:02:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

sysctl: Fix out of bounds access for empty sysctl registers

Browse Source 
When registering tables to the sysctl subsystem there is a check to see
if header is a permanently empty directory (used for mounts). This check
evaluates the first element of the ctl_table. This results in an out of
bounds evaluation when registering empty directories.

The function register_sysctl_mount_point now passes a ctl_table of size
1 instead of size 0. It now relies solely on the type to identify
a permanently empty register.

Make sure that the ctl_table has at least one element before testing for
permanent emptiness.

Signed-off-by: Joel Granados <j.granados@samsung.com>
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202311201431.57aae8f3-oliver.sang@intel.com
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
This commit is contained in:
Joel Granados 2023-11-21 12:02:18 +01:00 committed by Luis Chamberlain
parent 05c1a8d01f
commit 315552310c
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
fs/proc/proc_sysctl.c
View File

@ -44,7 +44,7 @@ static struct ctl_table sysctl_mount_point[] = {
*/
struct ctl_table_header *register_sysctl_mount_point(const char *path)
{
return register_sysctl_sz(path, sysctl_mount_point, 0);
return register_sysctl(path, sysctl_mount_point);
}
EXPORT_SYMBOL(register_sysctl_mount_point);
@ -233,7 +233,8 @@ static int insert_header(struct ctl_dir *dir, struct ctl_table_header *header)
return -EROFS;
/* Am I creating a permanently empty directory? */
if (sysctl_is_perm_empty_ctl_table(header->ctl_table)) {
if (header->ctl_table_size > 0 &&
sysctl_is_perm_empty_ctl_table(header->ctl_table)) {
if (!RB_EMPTY_ROOT(&dir->root))
return -EINVAL;
sysctl_set_perm_empty_ctl_header(dir_h);
@ -1213,6 +1214,10 @@ static bool get_links(struct ctl_dir *dir,
struct ctl_table_header *tmp_head;
struct ctl_table *entry, *link;
if (header->ctl_table_size == 0 ||
sysctl_is_perm_empty_ctl_table(header->ctl_table))
return true;
/* Are there links available for every entry in table? */
list_for_each_table_entry(entry, header) {
const char *procname = entry->procname;