1 files changed, 26 insertions, 33 deletions

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 0854197e0e67..e5da394d1ca3 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2643,32 +2643,25 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp,
                                         int *valp,
                                         int write, void *data)
 {
+        int tmp, ret;
         struct do_proc_dointvec_minmax_conv_param *param = data;
+        /*
+         * If writing, first do so via a temporary local int so we can
+         * bounds-check it before touching *valp.
+         */
+        int *ip = write ? &tmp : valp;
+
+        ret = do_proc_dointvec_conv(negp, lvalp, ip, write, data);
+        if (ret)
+                return ret;
+
         if (write) {
-                int val;
-                if (*negp) {
-                        if (*lvalp > (unsigned long) INT_MAX + 1)
-                                return -EINVAL;
-                        val = -*lvalp;
-                } else {
-                        if (*lvalp > (unsigned long) INT_MAX)
-                                return -EINVAL;
-                        val = *lvalp;
-                }
-                if ((param->min && *param->min > val) ||
-                    (param->max && *param->max < val))
+                if ((param->min && *param->min > tmp) ||
+                    (param->max && *param->max < tmp))
                         return -EINVAL;
-                *valp = val;
-        } else {
-                int val = *valp;
-                if (val < 0) {
-                        *negp = true;
-                        *lvalp = -(unsigned long)val;
-                } else {
-                        *negp = false;
-                        *lvalp = (unsigned long)val;
-                }
+                *valp = tmp;
         }
+
         return 0;
 }
 
@@ -2717,22 +2710,22 @@ static int do_proc_douintvec_minmax_conv(unsigned long *lvalp,
                                          unsigned int *valp,
                                          int write, void *data)
 {
+        int ret;
+        unsigned int tmp;
         struct do_proc_douintvec_minmax_conv_param *param = data;
+        /* write via temporary local uint for bounds-checking */
+        unsigned int *up = write ? &tmp : valp;
 
-        if (write) {
-                unsigned int val = *lvalp;
+        ret = do_proc_douintvec_conv(lvalp, up, write, data);
+        if (ret)
+                return ret;
 
-                if (*lvalp > UINT_MAX)
-                        return -EINVAL;
-
-                if ((param->min && *param->min > val) ||
-                    (param->max && *param->max < val))
+        if (write) {
+                if ((param->min && *param->min > tmp) ||
+                    (param->max && *param->max < tmp))
                         return -ERANGE;
 
-                *valp = val;
-        } else {
-                unsigned int val = *valp;
-                *lvalp = (unsigned long) val;
+                *valp = tmp;
         }
 
         return 0;