[RFC PATCH] kernel/sysctl: detect overflows when converting to uint

[Yisheng Xie]

Commit 230633d109e3 ("kernel/sysctl.c: detect overflows when converting
to int") prevented writing to sysctl entries when integer overflow occurs.
However, this does not apply to unsigned integers.

To fix this, commit e7d316a02f68 ("sysctl: handle error writing UINT_MAX
to u32 fields") introduce a new proc handler proc_douintvec, however do
not handle the overflowing of unsigned int.

E.g. on a system where int has 32 bits and long has 64 bits
  echo 0x100001234 > /proc/sys/net/core/xfrm_aevent_etime
has the same effect as
  echo 0x1234 > /proc/sys/net/core/xfrm_aevent_etime

The patch adds the missing check in do_proc_douintvec_conv.

With the patch an overflow of unsigned int will result in an error
EINVAL when writing to the the sysctl file system.

Signed-off-by: Yisheng Xie <xieyisheng1@xxxxxxxxxx>
---
 kernel/sysctl.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 706309f..762ecf3 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2146,6 +2146,10 @@ static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp,
 	if (write) {
 		if (*negp)
 			return -EINVAL;
+
+		if (*lvalp > (unsigned long) UINT_MAX)
+			return -EINVAL;
+
 		*valp = *lvalp;
 	} else {
 		unsigned int val = *valp;
-- 
1.7.12.4