1 files changed, 78 insertions, 16 deletions

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 40ce2d983b12..db19e3e2aa4b 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -173,6 +173,13 @@ extern int no_unaligned_warning;
 #endif
 
 #ifdef CONFIG_PROC_SYSCTL
+
+#define SYSCTL_WRITES_LEGACY    -1
+#define SYSCTL_WRITES_WARN       0
+#define SYSCTL_WRITES_STRICT     1
+
+static int sysctl_writes_strict = SYSCTL_WRITES_WARN;
+
 static int proc_do_cad_pid(struct ctl_table *table, int write,
                   void __user *buffer, size_t *lenp, loff_t *ppos);
 static int proc_taint(struct ctl_table *table, int write,
@@ -195,7 +202,7 @@ static int proc_dostring_coredump(struct ctl_table *table, int write,
 /* Note: sysrq code uses it's own private copy */
 static int __sysrq_enabled = CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE;
 
-static int sysrq_sysctl_handler(ctl_table *table, int write,
+static int sysrq_sysctl_handler(struct ctl_table *table, int write,
                                 void __user *buffer, size_t *lenp,
                                 loff_t *ppos)
 {
@@ -495,6 +502,15 @@ static struct ctl_table kern_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_taint,
         },
+        {
+                .procname       = "sysctl_writes_strict",
+                .data           = &sysctl_writes_strict,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &neg_one,
+                .extra2         = &one,
+        },
 #endif
 #ifdef CONFIG_LATENCYTOP
         {
@@ -1703,8 +1719,8 @@ int __init sysctl_init(void)
 
 #ifdef CONFIG_PROC_SYSCTL
 
-static int _proc_do_string(void* data, int maxlen, int write,
-                           void __user *buffer,
+static int _proc_do_string(char *data, int maxlen, int write,
+                           char __user *buffer,
                            size_t *lenp, loff_t *ppos)
 {
         size_t len;
@@ -1717,21 +1733,30 @@ static int _proc_do_string(void* data, int maxlen, int write,
         }
 
         if (write) {
-                len = 0;
+                if (sysctl_writes_strict == SYSCTL_WRITES_STRICT) {
+                        /* Only continue writes not past the end of buffer. */
+                        len = strlen(data);
+                        if (len > maxlen - 1)
+                                len = maxlen - 1;
+
+                        if (*ppos > len)
+                                return 0;
+                        len = *ppos;
+                } else {
+                        /* Start writing from beginning of buffer. */
+                        len = 0;
+                }
+
+                *ppos += *lenp;
                 p = buffer;
-                while (len < *lenp) {
+                while ((p - buffer) < *lenp && len < maxlen - 1) {
                         if (get_user(c, p++))
                                 return -EFAULT;
                         if (c == 0 || c == '\n')
                                 break;
-                        len++;
+                        data[len++] = c;
                 }
-                if (len >= maxlen)
-                        len = maxlen-1;
-                if(copy_from_user(data, buffer, len))
-                        return -EFAULT;
-                ((char *) data)[len] = 0;
-                *ppos += *lenp;
+                data[len] = 0;
         } else {
                 len = strlen(data);
                 if (len > maxlen)
@@ -1748,10 +1773,10 @@ static int _proc_do_string(void* data, int maxlen, int write,
                 if (len > *lenp)
                         len = *lenp;
                 if (len)
-                        if(copy_to_user(buffer, data, len))
+                        if (copy_to_user(buffer, data, len))
                                 return -EFAULT;
                 if (len < *lenp) {
-                        if(put_user('\n', ((char __user *) buffer) + len))
+                        if (put_user('\n', buffer + len))
                                 return -EFAULT;
                         len++;
                 }
@@ -1761,6 +1786,14 @@ static int _proc_do_string(void* data, int maxlen, int write,
         return 0;
 }
 
+static void warn_sysctl_write(struct ctl_table *table)
+{
+        pr_warn_once("%s wrote to %s when file position was not 0!\n"
+                "This will not be supported in the future. To silence this\n"
+                "warning, set kernel.sysctl_writes_strict = -1\n",
+                current->comm, table->procname);
+}
+
 /**
  * proc_dostring - read a string sysctl
  * @table: the sysctl table
@@ -1781,8 +1814,11 @@ static int _proc_do_string(void* data, int maxlen, int write,
 int proc_dostring(struct ctl_table *table, int write,
                   void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-        return _proc_do_string(table->data, table->maxlen, write,
-                               buffer, lenp, ppos);
+        if (write && *ppos && sysctl_writes_strict == SYSCTL_WRITES_WARN)
+                warn_sysctl_write(table);
+
+        return _proc_do_string((char *)(table->data), table->maxlen, write,
+                               (char __user *)buffer, lenp, ppos);
 }
 
 static size_t proc_skip_spaces(char **buf)
@@ -1956,6 +1992,18 @@ static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
                 conv = do_proc_dointvec_conv;
 
         if (write) {
+                if (*ppos) {
+                        switch (sysctl_writes_strict) {
+                        case SYSCTL_WRITES_STRICT:
+                                goto out;
+                        case SYSCTL_WRITES_WARN:
+                                warn_sysctl_write(table);
+                                break;
+                        default:
+                                break;
+                        }
+                }
+
                 if (left > PAGE_SIZE - 1)
                         left = PAGE_SIZE - 1;
                 page = __get_free_page(GFP_TEMPORARY);
@@ -2013,6 +2061,7 @@ free:
                         return err ? : -EINVAL;
         }
         *lenp -= left;
+out:
         *ppos += *lenp;
         return err;
 }
@@ -2205,6 +2254,18 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
         left = *lenp;
 
         if (write) {
+                if (*ppos) {
+                        switch (sysctl_writes_strict) {
+                        case SYSCTL_WRITES_STRICT:
+                                goto out;
+                        case SYSCTL_WRITES_WARN:
+                                warn_sysctl_write(table);
+                                break;
+                        default:
+                                break;
+                        }
+                }
+
                 if (left > PAGE_SIZE - 1)
                         left = PAGE_SIZE - 1;
                 page = __get_free_page(GFP_TEMPORARY);
@@ -2260,6 +2321,7 @@ free:
                         return err ? : -EINVAL;
         }
         *lenp -= left;
+out:
         *ppos += *lenp;
         return err;
 }