From e6cfaf34be9fcd1a8285a294e18986bfc41a409c Mon Sep 17 00:00:00 2001

From: Linus Torvalds <torvalds@linux-foundation.org>

Date: Mon, 5 Dec 2022 11:33:40 -0800

Subject: [PATCH] proc: avoid integer type confusion in get_proc_long

Git-commit: e6cfaf34be9fcd1a8285a294e18986bfc41a409c

Patch-mainline: v6.1

References: CVE-2022-4378 bsc#1206207

proc_get_long() is passed a size_t, but then assigns it to an 'int'

variable for the length.  Let's not do that, even if our IO paths are

limited to MAX_RW_COUNT (exactly because of these kinds of type errors).

So do the proper test in the rigth type.

Reported-by: Kyle Zeng <zengyhkyle@gmail.com>

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Acked-by: Takashi Iwai <tiwai@suse.de>

---

 kernel/sysctl.c | 5 ++---

 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/kernel/sysctl.c b/kernel/sysctl.c

index 188c305aeb8b..8898ddeaaf75 100644

--- a/kernel/sysctl.c

+++ b/kernel/sysctl.c

@@ -342,13 +342,12 @@ static int proc_get_long(char **buf, size_t *size,

 			  unsigned long *val, bool *neg,

 			  const char *perm_tr, unsigned perm_tr_len, char *tr)

 {

-	int len;

 	char *p, tmp[TMPBUFLEN];

+	ssize_t len = *size;

-	if (!*size)

+	if (len <= 0)

 		return -EINVAL;

-	len = *size;

 	if (len > TMPBUFLEN - 1)

 		len = TMPBUFLEN - 1;

-- 

2.35.3