sysctl: Error on bad sysctl tables

After going through the kernels sysctl tables several times it has become
clear that code review and testing is just not effective in prevent
problematic sysctl tables from being used in the stable kernel.  I certainly
can't seem to fix the problems as fast as they are introduced.

Therefore this patch adds sysctl_check_table which is called when a sysctl
table is registered and checks to see if we have a problematic sysctl table.

The biggest part of the code is the table of valid binary sysctl entries, but
since we have frozen our set of binary sysctls this table should not need to
change, and it makes it much easier to detect when someone unintentionally
adds a new binary sysctl value.

As best as I can determine all of the several hundred errors spewed on boot up
now are legitimate.

[bunk@kernel.org: kernel/sysctl_check.c must #include <linux/string.h>]
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Cc: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

3 files changed, 1563 insertions, 1 deletions

diff --git a/kernel/Makefile b/kernel/Makefile
index 2a999836ca18..d63fbb18798a 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -9,7 +9,7 @@ obj-y     = sched.o fork.o exec_domain.o panic.o printk.o profile.o \
             rcupdate.o extable.o params.o posix-timers.o \
             kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
             hrtimer.o rwsem.o latency.o nsproxy.o srcu.o die_notifier.o \
-            utsname.o
+            utsname.o sysctl_check.o
 
 obj-$(CONFIG_STACKTRACE) += stacktrace.o
 obj-y += time/
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index c7150af631b5..62e53a0de4a3 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1461,7 +1461,9 @@ static void sysctl_set_parent(struct ctl_table *parent, struct ctl_table *table)
 
 static __init int sysctl_init(void)
 {
+        int err;
         sysctl_set_parent(NULL, root_table);
+        err = sysctl_check_table(root_table);
         return 0;
 }
 
@@ -1546,6 +1548,10 @@ struct ctl_table_header *register_sysctl_table(struct ctl_table * table)
         tmp->used = 0;
         tmp->unregistering = NULL;
         sysctl_set_parent(NULL, table);
+        if (sysctl_check_table(tmp->ctl_table)) {
+                kfree(tmp);
+                return NULL;
+        }
         spin_lock(&sysctl_lock);
         list_add_tail(&tmp->ctl_entry, &root_table_header.ctl_entry);
         spin_unlock(&sysctl_lock);
diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
new file mode 100644
index 000000000000..8bce52cc06d4
--- /dev/null
+++ b/kernel/sysctl_check.c
@@ -0,0 +1,1556 @@
+#include <linux/stat.h>
+#include <linux/sysctl.h>
+#include "../arch/s390/appldata/appldata.h"
+#include "../fs/xfs/linux-2.6/xfs_sysctl.h"
+#include <linux/sunrpc/debug.h>
+#include <linux/string.h>
+#include <net/ip_vs.h>
+
+struct trans_ctl_table {
+        int                     ctl_name;
+        const char              *procname;
+        struct trans_ctl_table  *child;
+};
+
+static struct trans_ctl_table trans_random_table[] = {
+        { RANDOM_POOLSIZE,      "poolsize" },
+        { RANDOM_ENTROPY_COUNT, "entropy_avail" },
+        { RANDOM_READ_THRESH,   "read_wakeup_threshold" },
+        { RANDOM_WRITE_THRESH,  "write_wakeup_threshold" },
+        { RANDOM_BOOT_ID,       "boot_id" },
+        { RANDOM_UUID,          "uuid" },
+        {}
+};
+
+static struct trans_ctl_table trans_pty_table[] = {
+        { PTY_MAX,              "max" },
+        { PTY_NR,               "nr" },
+        {}
+};
+
+static struct trans_ctl_table trans_kern_table[] = {
+        { KERN_OSTYPE,                  "ostype" },
+        { KERN_OSRELEASE,               "osrelease" },
+        /* KERN_OSREV not used */
+        { KERN_VERSION,                 "version" },
+        /* KERN_SECUREMASK not used */
+        /* KERN_PROF not used */
+        { KERN_NODENAME,                "hostname" },
+        { KERN_DOMAINNAME,              "domainname" },
+
+        { KERN_CAP_BSET,                "cap-bound" },
+        { KERN_PANIC,                   "panic" },
+        { KERN_REALROOTDEV,             "real-root-dev" },
+
+        { KERN_SPARC_REBOOT,            "reboot-cmd" },
+        { KERN_CTLALTDEL,               "ctrl-alt-del" },
+        { KERN_PRINTK,                  "printk" },
+
+        /* KERN_NAMETRANS not used */
+        /* KERN_PPC_HTABRECLAIM not used */
+        /* KERN_PPC_ZEROPAGED not used */
+        { KERN_PPC_POWERSAVE_NAP,       "powersave-nap" },
+
+        { KERN_MODPROBE,                "modprobe" },
+        { KERN_SG_BIG_BUFF,             "sg-big-buff" },
+        { KERN_ACCT,                    "acct" },
+        { KERN_PPC_L2CR,                "l2cr" },
+
+        /* KERN_RTSIGNR not used */
+        /* KERN_RTSIGMAX not used */
+
+        { KERN_SHMMAX,                  "shmmax" },
+        { KERN_MSGMAX,                  "msgmax" },
+        { KERN_MSGMNB,                  "msgmnb" },
+        /* KERN_MSGPOOL not used*/
+        { KERN_SYSRQ,                   "sysrq" },
+        { KERN_MAX_THREADS,             "threads-max" },
+        { KERN_RANDOM,                  "random",       trans_random_table },
+        { KERN_SHMALL,                  "shmall" },
+        { KERN_MSGMNI,                  "msgmni" },
+        { KERN_SEM,                     "sem" },
+        { KERN_SPARC_STOP_A,            "stop-a" },
+        { KERN_SHMMNI,                  "shmmni" },
+
+        { KERN_OVERFLOWUID,             "overflowuid" },
+        { KERN_OVERFLOWGID,             "overflowgid" },
+
+        { KERN_HOTPLUG,                 "hotplug", },
+        { KERN_IEEE_EMULATION_WARNINGS, "ieee_emulation_warnings" },
+
+        { KERN_S390_USER_DEBUG_LOGGING, "userprocess_debug" },
+        { KERN_CORE_USES_PID,           "core_uses_pid" },
+        { KERN_TAINTED,                 "tainted" },
+        { KERN_CADPID,                  "cad_pid" },
+        { KERN_PIDMAX,                  "pid_max" },
+        { KERN_CORE_PATTERN,            "core_pattern" },
+        { KERN_PANIC_ON_OOPS,           "panic_on_oops" },
+        { KERN_HPPA_PWRSW,              "soft-power" },
+        { KERN_HPPA_UNALIGNED,          "unaligned-trap" },
+
+        { KERN_PRINTK_RATELIMIT,        "printk_ratelimit" },
+        { KERN_PRINTK_RATELIMIT_BURST,  "printk_ratelimit_burst" },
+
+        { KERN_PTY,                     "pty",          trans_pty_table },
+        { KERN_NGROUPS_MAX,             "ngroups_max" },
+        { KERN_SPARC_SCONS_PWROFF,      "scons_poweroff" },
+        { KERN_HZ_TIMER,                "hz_timer" },
+        { KERN_UNKNOWN_NMI_PANIC,       "unknown_nmi_panic" },
+        { KERN_BOOTLOADER_TYPE,         "bootloader_type" },
+        { KERN_RANDOMIZE,               "randomize_va_space" },
+
+        { KERN_SPIN_RETRY,              "spin_retry" },
+        { KERN_ACPI_VIDEO_FLAGS,        "acpi_video_flags" },
+        { KERN_IA64_UNALIGNED,          "ignore-unaligned-usertrap" },
+        { KERN_COMPAT_LOG,              "compat-log" },
+        { KERN_MAX_LOCK_DEPTH,          "max_lock_depth" },
+        { KERN_NMI_WATCHDOG,            "nmi_watchdog" },
+        { KERN_PANIC_ON_NMI,            "panic_on_unrecovered_nmi" },
+        {}
+};
+
+static struct trans_ctl_table trans_vm_table[] = {
+        { VM_OVERCOMMIT_MEMORY,         "overcommit_memory" },
+        { VM_PAGE_CLUSTER,              "page-cluster" },
+        { VM_DIRTY_BACKGROUND,          "dirty_background_ratio" },
+        { VM_DIRTY_RATIO,               "dirty_ratio" },
+        { VM_DIRTY_WB_CS,               "dirty_writeback_centisecs" },
+        { VM_DIRTY_EXPIRE_CS,           "dirty_expire_centisecs" },
+        { VM_NR_PDFLUSH_THREADS,        "nr_pdflush_threads" },
+        { VM_OVERCOMMIT_RATIO,          "overcommit_ratio" },
+        /* VM_PAGEBUF unused */
+        { VM_HUGETLB_PAGES,             "nr_hugepages" },
+        { VM_SWAPPINESS,                "swappiness" },
+        { VM_LOWMEM_RESERVE_RATIO,      "lowmem_reserve_ratio" },
+        { VM_MIN_FREE_KBYTES,           "min_free_kbytes" },
+        { VM_MAX_MAP_COUNT,             "max_map_count" },
+        { VM_LAPTOP_MODE,               "laptop_mode" },
+        { VM_BLOCK_DUMP,                "block_dump" },
+        { VM_HUGETLB_GROUP,             "hugetlb_shm_group" },
+        { VM_VFS_CACHE_PRESSURE,        "vfs_cache_pressure" },
+        { VM_LEGACY_VA_LAYOUT,          "legacy_va_layout" },
+        /* VM_SWAP_TOKEN_TIMEOUT unused */
+        { VM_DROP_PAGECACHE,            "drop_caches" },
+        { VM_PERCPU_PAGELIST_FRACTION,  "percpu_pagelist_fraction" },
+        { VM_ZONE_RECLAIM_MODE,         "zone_reclaim_mode" },
+        { VM_MIN_UNMAPPED,              "min_unmapped_ratio" },
+        { VM_PANIC_ON_OOM,              "panic_on_oom" },
+        { VM_VDSO_ENABLED,              "vdso_enabled" },
+        { VM_MIN_SLAB,                  "min_slab_ratio" },
+        { VM_CMM_PAGES,                 "cmm_pages" },
+        { VM_CMM_TIMED_PAGES,           "cmm_timed_pages" },
+        { VM_CMM_TIMEOUT,               "cmm_timeout" },
+
+        {}