iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
302fdadeaf
linux/fs/proc
History
Xiaoming Ni 697edcb0e4 proc_sysctl: fix oops caused by incorrect command parameters 
The process_sysctl_arg() does not check whether val is empty before
invoking strlen(val).  If the command line parameter () is incorrectly
configured and val is empty, oops is triggered.

For example:
  "hung_task_panic=1" is incorrectly written as "hung_task_panic", oops is
  triggered. The call stack is as follows:
    Kernel command line: .... hung_task_panic
    ......
    Call trace:
    __pi_strlen+0x10/0x98
    parse_args+0x278/0x344
    do_sysctl_args+0x8c/0xfc
    kernel_init+0x5c/0xf4
    ret_from_fork+0x10/0x30

To fix it, check whether "val" is empty when "phram" is a sysctl field.
Error codes are returned in the failure branch, and error logs are
generated by parse_args().

Link: https://lkml.kernel.org/r/20210118133029.28580-1-nixiaoming@huawei.com
Fixes: 3db978d480 ("kernel/sysctl: support setting sysctl parameters from kernel command line")
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Iurii Zaikin <yzaikin@google.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Heiner Kallweit <hkallweit1@gmail.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: <stable@vger.kernel.org>	[5.8+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-01-24 10:34:53 -08:00
..
array.c proc: provide details on indirect branch speculation 2020-12-15 22:46:15 -08:00
base.c seccomp updates for v5.11-rc1 2020-12-16 11:30:10 -08:00
bootconfig.c proc/bootconfig: Fix to use correct quotes for value 2020-06-16 21:21:03 -04:00
cmdline.c
consoles.c
cpuinfo.c proc/cpuinfo: switch to ->read_iter 2020-11-06 10:05:18 -08:00
devices.c block: move block-related definitions out of fs.h 2020-06-24 09:16:02 -06:00
fd.c proc/fd: In fdinfo seq_show don't use get_files_struct 2020-12-10 12:42:58 -06:00
fd.h
generic.c proc: fix lookup in /proc/net subdirectories after setns(2) 2020-12-15 22:46:15 -08:00
inode.c proc: wire up generic_file_splice_read for iter ops 2020-11-06 10:05:18 -08:00
internal.h fs/proc: make pde_get() return nothing 2020-12-15 22:46:15 -08:00
interrupts.c
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
kcore.c arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL 2020-12-15 12:13:42 -08:00
kmsg.c
loadavg.c
Makefile
meminfo.c mm: memcontrol: account pagetables per node 2020-12-15 12:13:40 -08:00
namespaces.c
nommu.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00
page.c mm: Add PG_arch_2 page flag 2020-09-04 12:46:06 +01:00
proc_net.c proc: fix lookup in /proc/net subdirectories after setns(2) 2020-12-15 22:46:15 -08:00
proc_sysctl.c proc_sysctl: fix oops caused by incorrect command parameters 2021-01-24 10:34:53 -08:00
proc_tty.c
root.c proc: s_fs_info may be NULL when proc_kill_sb is called 2020-06-10 14:54:54 -05:00
self.c proc: don't allow async path resolution of /proc/self components 2020-11-13 16:47:52 -07:00
softirqs.c
stat.c time-namespace-v5.11 2020-12-14 16:35:39 -08:00
task_mmu.c mm: don't play games with pinned pages in clear_page_refs 2021-01-16 10:51:26 -08:00
task_nommu.c mmap locking API: use coccinelle to convert mmap_sem rwsem call sites 2020-06-09 09:39:14 -07:00
thread_self.c proc: Use new_inode not new_inode_pseudo 2020-06-12 14:13:33 -05:00
uptime.c
util.c
version.c
vmcore.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00