diff options
| author | Andrey Ryabinin <a.ryabinin@samsung.com> | 2015-02-10 14:11:33 -0800 |
|---|---|---|
| committer | Sasha Levin <sasha.levin@oracle.com> | 2015-03-14 15:37:15 -0400 |
| commit | 6f59e648688b38af6144a81e1d493f33cd2fe6f1 (patch) | |
| tree | 6bfecddc6d6e52ebde426390433e4beff2d3f8c9 /kernel | |
| parent | ac369918c6c1eca4c3b99761d2299d8df9e7bffb (diff) | |
mm, hugetlb: remove unnecessary lower bound on sysctl handlers"?
commit 3cd7645de624939c38f5124b4ac15f8b35a1a8b7 upstream.
Commit ed4d4902ebdd ("mm, hugetlb: remove hugetlb_zero and
hugetlb_infinity") replaced 'unsigned long hugetlb_zero' with 'int zero'
leading to out-of-bounds access in proc_doulongvec_minmax(). Use
'.extra1 = NULL' instead of '.extra1 = &zero'. Passing NULL is
equivalent to passing minimal value, which is 0 for unsigned types.
Fixes: ed4d4902ebdd ("mm, hugetlb: remove hugetlb_zero and hugetlb_infinity")
Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Suggested-by: Manfred Spraul <manfred@colorfullife.com>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/sysctl.c | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 15f2511a1b7c..cd0e835ecb85 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1232,7 +1232,6 @@ static struct ctl_table vm_table[] = { .maxlen = sizeof(unsigned long), .mode = 0644, .proc_handler = hugetlb_sysctl_handler, - .extra1 = &zero, }, #ifdef CONFIG_NUMA { @@ -1241,7 +1240,6 @@ static struct ctl_table vm_table[] = { .maxlen = sizeof(unsigned long), .mode = 0644, .proc_handler = &hugetlb_mempolicy_sysctl_handler, - .extra1 = &zero, }, #endif { @@ -1264,7 +1262,6 @@ static struct ctl_table vm_table[] = { .maxlen = sizeof(unsigned long), .mode = 0644, .proc_handler = hugetlb_overcommit_handler, - .extra1 = &zero, }, #endif { |