1 files changed, 42 insertions, 1 deletions

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 14f30b4a1b64..3fb1405f3f8c 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -67,6 +67,8 @@
 #include <linux/bpf.h>
 #include <linux/mount.h>
 
+#include "../lib/kstrtox.h"
+
 #include <linux/uaccess.h>
 #include <asm/processor.h>
 
@@ -127,6 +129,7 @@ static int __maybe_unused one = 1;
 static int __maybe_unused two = 2;
 static int __maybe_unused four = 4;
 static unsigned long one_ul = 1;
+static unsigned long long_max = LONG_MAX;
 static int one_hundred = 100;
 static int one_thousand = 1000;
 #ifdef CONFIG_PRINTK
@@ -1747,6 +1750,8 @@ static struct ctl_table fs_table[] = {
                 .maxlen         = sizeof(files_stat.max_files),
                 .mode           = 0644,
                 .proc_handler   = proc_doulongvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &long_max,
         },
         {
                 .procname       = "nr_open",
@@ -2117,6 +2122,41 @@ static void proc_skip_char(char **buf, size_t *size, const char v)
         }
 }
 
+/**
+ * strtoul_lenient - parse an ASCII formatted integer from a buffer and only
+ *                   fail on overflow
+ *
+ * @cp: kernel buffer containing the string to parse
+ * @endp: pointer to store the trailing characters
+ * @base: the base to use
+ * @res: where the parsed integer will be stored
+ *
+ * In case of success 0 is returned and @res will contain the parsed integer,
+ * @endp will hold any trailing characters.
+ * This function will fail the parse on overflow. If there wasn't an overflow
+ * the function will defer the decision what characters count as invalid to the
+ * caller.
+ */
+static int strtoul_lenient(const char *cp, char **endp, unsigned int base,
+                           unsigned long *res)
+{
+        unsigned long long result;
+        unsigned int rv;
+
+        cp = _parse_integer_fixup_radix(cp, &base);
+        rv = _parse_integer(cp, base, &result);
+        if ((rv & KSTRTOX_OVERFLOW) || (result != (unsigned long)result))
+                return -ERANGE;
+
+        cp += rv;
+
+        if (endp)
+                *endp = (char *)cp;
+
+        *res = (unsigned long)result;
+        return 0;
+}
+
 #define TMPBUFLEN 22
 /**
  * proc_get_long - reads an ASCII formatted integer from a user buffer
@@ -2160,7 +2200,8 @@ static int proc_get_long(char **buf, size_t *size,
         if (!isdigit(*p))
                 return -EINVAL;
 
-        *val = simple_strtoul(p, &p, 0);
+        if (strtoul_lenient(p, &p, 0, val))
+                return -EINVAL;
 
         len = p - tmp;