| Message ID | 20241217132908.38096-2-nicolas.bouchinet@clip-os.org |
|---|---|
| State | New |
| Headers | show |
| Series | Fixes multiple sysctl proc_handler usage error | expand |
On Tue 17-12-24 14:29:06, nicolas.bouchinet@clip-os.org wrote: > From: Nicolas Bouchinet <nicolas.bouchinet@ssi.gouv.fr> > > proc_dointvec converts a string to a vector of signed int, which is > stored in the unsigned int .data core_pipe_limit. > It was thus authorized to write a negative value to core_pipe_limit > sysctl which once stored in core_pipe_limit, leads to the signed int > dump_count check against core_pipe_limit never be true. The same can be > achieved with core_pipe_limit set to INT_MAX. > > Any negative write or >= to INT_MAX in core_pipe_limit sysctl would > hypothetically allow a user to create very high load on the system by > running processes that produces a coredump in case the core_pattern > sysctl is configured to pipe core files to user space helper. > Memory or PID exhaustion should happen before but it anyway breaks the > core_pipe_limit semantic. > > This commit fixes this by changing core_pipe_limit sysctl's proc_handler > to proc_dointvec_minmax and bound checking between SYSCTL_ZERO and > SYSCTL_INT_MAX. > > Fixes: a293980c2e26 ("exec: let do_coredump() limit the number of concurrent dumps to pipes") > Signed-off-by: Nicolas Bouchinet <nicolas.bouchinet@ssi.gouv.fr> Looks good. Feel free to add: Reviewed-by: Jan Kara <jack@suse.cz> Honza > --- > fs/coredump.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/fs/coredump.c b/fs/coredump.c > index 7f12ff6ad1d3e..c3a74dd194e69 100644 > --- a/fs/coredump.c > +++ b/fs/coredump.c > @@ -1024,7 +1024,9 @@ static struct ctl_table coredump_sysctls[] = { > .data = &core_pipe_limit, > .maxlen = sizeof(unsigned int), > .mode = 0644, > - .proc_handler = proc_dointvec, > + .proc_handler = proc_dointvec_minmax, > + .extra1 = SYSCTL_ZERO, > + .extra2 = SYSCTL_INT_MAX, > }, > { > .procname = "core_file_note_size_limit", > -- > 2.47.1 >
diff --git a/fs/coredump.c b/fs/coredump.c index 7f12ff6ad1d3e..c3a74dd194e69 100644 --- a/fs/coredump.c +++ b/fs/coredump.c @@ -1024,7 +1024,9 @@ static struct ctl_table coredump_sysctls[] = { .data = &core_pipe_limit, .maxlen = sizeof(unsigned int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_INT_MAX, }, { .procname = "core_file_note_size_limit",