[19/23] sysctl: Call sysctl_head_finish on error
diff mbox series

Message ID 20200701200951.3603160-20-hch@lst.de
State New
Headers show
Series
  • [01/23] cachefiles: switch to kernel_write
Related show

Commit Message

Christoph Hellwig July 1, 2020, 8:09 p.m. UTC
From: "Matthew Wilcox (Oracle)" <willy@infradead.org>

This error path returned directly instead of calling sysctl_head_finish().

Fixes: ef9d965bc8b6 ("sysctl: reject gigantic reads/write to sysctl files")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
---
 fs/proc/proc_sysctl.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Matthew Wilcox July 2, 2020, 12:32 a.m. UTC | #1
On Wed, Jul 01, 2020 at 10:09:47PM +0200, Christoph Hellwig wrote:
> From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
> 
> This error path returned directly instead of calling sysctl_head_finish().
> 
> Fixes: ef9d965bc8b6 ("sysctl: reject gigantic reads/write to sysctl files")
> Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>

I think this one needs to go to Linus before 5.8, not get stuck in the
middle of a large patch series.
Christoph Hellwig July 2, 2020, 5:15 a.m. UTC | #2
On Thu, Jul 02, 2020 at 01:32:40AM +0100, Matthew Wilcox wrote:
> On Wed, Jul 01, 2020 at 10:09:47PM +0200, Christoph Hellwig wrote:
> > From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
> > 
> > This error path returned directly instead of calling sysctl_head_finish().
> > 
> > Fixes: ef9d965bc8b6 ("sysctl: reject gigantic reads/write to sysctl files")
> > Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
> 
> I think this one needs to go to Linus before 5.8, not get stuck in the
> middle of a large patch series.

I've only kept it here because it didn't show up in Linus tree yet.
If you send it and it gets picked up I can trivially drop it.
Al Viro July 3, 2020, 1:34 a.m. UTC | #3
On Thu, Jul 02, 2020 at 07:15:12AM +0200, Christoph Hellwig wrote:
> On Thu, Jul 02, 2020 at 01:32:40AM +0100, Matthew Wilcox wrote:
> > On Wed, Jul 01, 2020 at 10:09:47PM +0200, Christoph Hellwig wrote:
> > > From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
> > > 
> > > This error path returned directly instead of calling sysctl_head_finish().
> > > 
> > > Fixes: ef9d965bc8b6 ("sysctl: reject gigantic reads/write to sysctl files")
> > > Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
> > 
> > I think this one needs to go to Linus before 5.8, not get stuck in the
> > middle of a large patch series.
> 
> I've only kept it here because it didn't show up in Linus tree yet.
> If you send it and it gets picked up I can trivially drop it.

I'll send it tonight, if it's not there yet...

Patch
diff mbox series

diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 42c5128c7d1c76..6c1166ccdaea57 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -566,8 +566,9 @@  static ssize_t proc_sys_call_handler(struct file *filp, void __user *ubuf,
 		goto out;
 
 	/* don't even try if the size is too large */
-	if (count > KMALLOC_MAX_SIZE)
-		return -ENOMEM;
+	error = -ENOMEM;
+	if (count >= KMALLOC_MAX_SIZE)
+		goto out;
 
 	if (write) {
 		kbuf = memdup_user_nul(ubuf, count);
@@ -576,7 +577,6 @@  static ssize_t proc_sys_call_handler(struct file *filp, void __user *ubuf,
 			goto out;
 		}
 	} else {
-		error = -ENOMEM;
 		kbuf = kzalloc(count, GFP_KERNEL);
 		if (!kbuf)
 			goto out;