1 files changed, 39 insertions, 1 deletions

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 14f30b4a1b64..1877ebe85c95 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -67,6 +67,8 @@
 #include <linux/bpf.h>
 #include <linux/mount.h>
 
+#include "../lib/kstrtox.h"
+
 #include <linux/uaccess.h>
 #include <asm/processor.h>
 
@@ -2117,6 +2119,41 @@ static void proc_skip_char(char **buf, size_t *size, const char v)
         }
 }
 
+/**
+ * strtoul_lenient - parse an ASCII formatted integer from a buffer and only
+ *                   fail on overflow
+ *
+ * @cp: kernel buffer containing the string to parse
+ * @endp: pointer to store the trailing characters
+ * @base: the base to use
+ * @res: where the parsed integer will be stored
+ *
+ * In case of success 0 is returned and @res will contain the parsed integer,
+ * @endp will hold any trailing characters.
+ * This function will fail the parse on overflow. If there wasn't an overflow
+ * the function will defer the decision what characters count as invalid to the
+ * caller.
+ */
+static int strtoul_lenient(const char *cp, char **endp, unsigned int base,
+                           unsigned long *res)
+{
+        unsigned long long result;
+        unsigned int rv;
+
+        cp = _parse_integer_fixup_radix(cp, &base);
+        rv = _parse_integer(cp, base, &result);
+        if ((rv & KSTRTOX_OVERFLOW) || (result != (unsigned long)result))
+                return -ERANGE;
+
+        cp += rv;
+
+        if (endp)
+                *endp = (char *)cp;
+
+        *res = (unsigned long)result;
+        return 0;
+}
+
 #define TMPBUFLEN 22
 /**
  * proc_get_long - reads an ASCII formatted integer from a user buffer
@@ -2160,7 +2197,8 @@ static int proc_get_long(char **buf, size_t *size,
         if (!isdigit(*p))
                 return -EINVAL;
 
-        *val = simple_strtoul(p, &p, 0);
+        if (strtoul_lenient(p, &p, 0, val))
+                return -EINVAL;
 
         len = p - tmp;