aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBart Samwel <bart@samwel.tk>2006-03-24 06:15:50 -0500
committerLinus Torvalds <torvalds@g5.osdl.org>2006-03-24 10:33:20 -0500
commitcba9f33d13a8ca3125b2a30abe2425ce562d8a83 (patch)
treee93e3da369be7e9f55d15d02908606a43cecfbb9
parented5b43f15a8e86e3ae939b98bc161ee973ecedf2 (diff)
[PATCH] Range checking in do_proc_dointvec_(userhz_)jiffies_conv
When (integer) sysctl values are in either seconds or centiseconds, but represented internally as jiffies, the allowable value range is decreased. This patch adds range checks to the conversion routines. For values in seconds: maximum LONG_MAX / HZ. For values in centiseconds: maximum (LONG_MAX / HZ) * USER_HZ. (BTW, does anyone else feel that an interface in seconds should not be accepting negative values?) Signed-off-by: Bart Samwel <bart@samwel.tk> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--kernel/sysctl.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index d13426680d10..e82726faeeff 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2053,6 +2053,8 @@ static int do_proc_dointvec_jiffies_conv(int *negp, unsigned long *lvalp,
2053 int write, void *data) 2053 int write, void *data)
2054{ 2054{
2055 if (write) { 2055 if (write) {
2056 if (*lvalp > LONG_MAX / HZ)
2057 return 1;
2056 *valp = *negp ? -(*lvalp*HZ) : (*lvalp*HZ); 2058 *valp = *negp ? -(*lvalp*HZ) : (*lvalp*HZ);
2057 } else { 2059 } else {
2058 int val = *valp; 2060 int val = *valp;
@@ -2074,6 +2076,8 @@ static int do_proc_dointvec_userhz_jiffies_conv(int *negp, unsigned long *lvalp,
2074 int write, void *data) 2076 int write, void *data)
2075{ 2077{
2076 if (write) { 2078 if (write) {
2079 if (USER_HZ < HZ && *lvalp > (LONG_MAX / HZ) * USER_HZ)
2080 return 1;
2077 *valp = clock_t_to_jiffies(*negp ? -*lvalp : *lvalp); 2081 *valp = clock_t_to_jiffies(*negp ? -*lvalp : *lvalp);
2078 } else { 2082 } else {
2079 int val = *valp; 2083 int val = *valp;