sysctl.c: fix underflow value setting risk in vm_table

BugLink: https://bugs.launchpad.net/bugs/1920246
[ Upstream commit 3b3376f222e3ab58367d9dd405cafd09d5e37b7c ]

Apart from subsystem specific .proc_handler handler, all ctl_tables with
extra1 and extra2 members set should use proc_dointvec_minmax instead of
proc_dointvec, or the limit set in extra* never work and potentially echo
underflow values(negative numbers) is likely make system unstable.

Especially vfs_cache_pressure and zone_reclaim_mode, -1 is apparently not
a valid value, but we can set to them.  And then kernel may crash.

# echo -1 > /proc/sys/vm/vfs_cache_pressure

Link: https://lkml.kernel.org/r/20201223105535.2875-1-linf@wangsu.com
Signed-off-by: Lin Feng <linf@wangsu.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kelsey Skunberg <kelsey.skunberg@canonical.com>

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 9797869ed829773a1a5c0feb54dbd72a01396e86..878d66b7b94d72e6dc7ce40d710cd67ae38f9935 100644 (file)
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1575,7 +1575,7 @@ static struct ctl_table vm_table[] = {
                .data           = &block_dump,
                .maxlen         = sizeof(block_dump),
                .mode           = 0644,
-               .proc_handler   = proc_dointvec,
+               .proc_handler   = proc_dointvec_minmax,
                .extra1         = SYSCTL_ZERO,
        },
        {
@@ -1583,7 +1583,7 @@ static struct ctl_table vm_table[] = {
                .data           = &sysctl_vfs_cache_pressure,
                .maxlen         = sizeof(sysctl_vfs_cache_pressure),
                .mode           = 0644,
-               .proc_handler   = proc_dointvec,
+               .proc_handler   = proc_dointvec_minmax,
                .extra1         = SYSCTL_ZERO,
        },
 #if defined(HAVE_ARCH_PICK_MMAP_LAYOUT) || \
@@ -1593,7 +1593,7 @@ static struct ctl_table vm_table[] = {
                .data           = &sysctl_legacy_va_layout,
                .maxlen         = sizeof(sysctl_legacy_va_layout),
                .mode           = 0644,
-               .proc_handler   = proc_dointvec,
+               .proc_handler   = proc_dointvec_minmax,
                .extra1         = SYSCTL_ZERO,
        },
 #endif
@@ -1603,7 +1603,7 @@ static struct ctl_table vm_table[] = {
                .data           = &node_reclaim_mode,
                .maxlen         = sizeof(node_reclaim_mode),
                .mode           = 0644,
-               .proc_handler   = proc_dointvec,
+               .proc_handler   = proc_dointvec_minmax,
                .extra1         = SYSCTL_ZERO,
        },
        {