Skip to content

Commit

Permalink
sysctl: fix proc_dobool() usability
Browse files Browse the repository at this point in the history
Currently proc_dobool expects a (bool *) in table->data, but sizeof(int)
in table->maxsize, because it uses do_proc_dointvec() directly.

This is unsafe for at least two reasons:
1. A sysctl table definition may use { .data = &variable, .maxsize =
   sizeof(variable) }, not realizing that this makes the sysctl unusable
   (see the Fixes: tag) and that they need to use the completely
   counterintuitive sizeof(int) instead.
2. proc_dobool() will currently try to parse an array of values if given
   .maxsize >= 2*sizeof(int), but will try to write values of type bool
   by offsets of sizeof(int), so it will not work correctly with neither
   an (int *) nor a (bool *). There is no .maxsize validation to prevent
   this.

Fix this by:
1. Constraining proc_dobool() to allow only one value and .maxsize ==
   sizeof(bool).
2. Wrapping the original struct ctl_table in a temporary one with .data
   pointing to a local int variable and .maxsize set to sizeof(int) and
   passing this one to proc_dointvec(), converting the value to/from
   bool as needed (using proc_dou8vec_minmax() as an example).
3. Extending sysctl_check_table() to enforce proc_dobool() expectations.
4. Fixing the proc_dobool() docstring (it was just copy-pasted from
   proc_douintvec, apparently...).
5. Converting all existing proc_dobool() users to set .maxsize to
   sizeof(bool) instead of sizeof(int).

Fixes: 83efeee ("tty: Allow TIOCSTI to be disabled")
Fixes: a207157 ("sysctl: introduce new proc handler proc_dobool")
Signed-off-by: Ondrej Mosnacek <[email protected]>
Acked-by: Kees Cook <[email protected]>
Signed-off-by: Luis Chamberlain <[email protected]>
  • Loading branch information
WOnder93 authored and mcgrof committed Feb 21, 2023
1 parent 1b72607 commit f1aa2eb
Show file tree
Hide file tree
Showing 4 changed files with 32 additions and 21 deletions.
2 changes: 1 addition & 1 deletion fs/lockd/svc.c
Original file line number Diff line number Diff line change
Expand Up @@ -496,7 +496,7 @@ static struct ctl_table nlm_sysctls[] = {
{
.procname = "nsm_use_hostnames",
.data = &nsm_use_hostnames,
.maxlen = sizeof(int),
.maxlen = sizeof(bool),
.mode = 0644,
.proc_handler = proc_dobool,
},
Expand Down
6 changes: 6 additions & 0 deletions fs/proc/proc_sysctl.c
Original file line number Diff line number Diff line change
Expand Up @@ -1124,6 +1124,11 @@ static int sysctl_check_table_array(const char *path, struct ctl_table *table)
err |= sysctl_err(path, table, "array not allowed");
}

if (table->proc_handler == proc_dobool) {
if (table->maxlen != sizeof(bool))
err |= sysctl_err(path, table, "array not allowed");
}

return err;
}

Expand All @@ -1136,6 +1141,7 @@ static int sysctl_check_table(const char *path, struct ctl_table *table)
err |= sysctl_err(path, entry, "Not a file");

if ((entry->proc_handler == proc_dostring) ||
(entry->proc_handler == proc_dobool) ||
(entry->proc_handler == proc_dointvec) ||
(entry->proc_handler == proc_douintvec) ||
(entry->proc_handler == proc_douintvec_minmax) ||
Expand Down
43 changes: 24 additions & 19 deletions kernel/sysctl.c
Original file line number Diff line number Diff line change
Expand Up @@ -425,21 +425,6 @@ static void proc_put_char(void **buf, size_t *size, char c)
}
}

static int do_proc_dobool_conv(bool *negp, unsigned long *lvalp,
int *valp,
int write, void *data)
{
if (write) {
*(bool *)valp = *lvalp;
} else {
int val = *(bool *)valp;

*lvalp = (unsigned long)val;
*negp = false;
}
return 0;
}

static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp,
int *valp,
int write, void *data)
Expand Down Expand Up @@ -710,16 +695,36 @@ int do_proc_douintvec(struct ctl_table *table, int write,
* @lenp: the size of the user buffer
* @ppos: file position
*
* Reads/writes up to table->maxlen/sizeof(unsigned int) integer
* values from/to the user buffer, treated as an ASCII string.
* Reads/writes one integer value from/to the user buffer,
* treated as an ASCII string.
*
* table->data must point to a bool variable and table->maxlen must
* be sizeof(bool).
*
* Returns 0 on success.
*/
int proc_dobool(struct ctl_table *table, int write, void *buffer,
size_t *lenp, loff_t *ppos)
{
return do_proc_dointvec(table, write, buffer, lenp, ppos,
do_proc_dobool_conv, NULL);
struct ctl_table tmp;
bool *data = table->data;
int res, val;

/* Do not support arrays yet. */
if (table->maxlen != sizeof(bool))
return -EINVAL;

tmp = *table;
tmp.maxlen = sizeof(val);
tmp.data = &val;

val = READ_ONCE(*data);
res = proc_dointvec(&tmp, write, buffer, lenp, ppos);
if (res)
return res;
if (write)
WRITE_ONCE(*data, val);
return 0;
}

/**
Expand Down
2 changes: 1 addition & 1 deletion mm/hugetlb_vmemmap.c
Original file line number Diff line number Diff line change
Expand Up @@ -581,7 +581,7 @@ static struct ctl_table hugetlb_vmemmap_sysctls[] = {
{
.procname = "hugetlb_optimize_vmemmap",
.data = &vmemmap_optimize_enabled,
.maxlen = sizeof(int),
.maxlen = sizeof(vmemmap_optimize_enabled),
.mode = 0644,
.proc_handler = proc_dobool,
},
Expand Down

0 comments on commit f1aa2eb

Please sign in to comment.