6.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Bouchinet nicolas.bouchinet@ssi.gouv.fr
[ Upstream commit 049439e22825507a90d4dedf3934e24fd0a8ff62 ]
proc_dointvec converts a string to a vector of signed int, which is stored in the unsigned int .data core_pipe_limit. It was thus authorized to write a negative value to core_pipe_limit sysctl which once stored in core_pipe_limit, leads to the signed int dump_count check against core_pipe_limit never be true. The same can be achieved with core_pipe_limit set to INT_MAX.
Any negative write or >= to INT_MAX in core_pipe_limit sysctl would hypothetically allow a user to create very high load on the system by running processes that produces a coredump in case the core_pattern sysctl is configured to pipe core files to user space helper. Memory or PID exhaustion should happen before but it anyway breaks the core_pipe_limit semantic.
This commit fixes this by changing core_pipe_limit sysctl's proc_handler to proc_dointvec_minmax and bound checking between SYSCTL_ZERO and SYSCTL_INT_MAX.
Fixes: a293980c2e26 ("exec: let do_coredump() limit the number of concurrent dumps to pipes") Signed-off-by: Nicolas Bouchinet nicolas.bouchinet@ssi.gouv.fr Reviewed-by: Jan Kara jack@suse.cz Reviewed-by: Kees Cook kees@kernel.org Signed-off-by: Joel Granados joel.granados@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- fs/coredump.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/coredump.c b/fs/coredump.c index 4375c70144d0a..4ebec51fe4f22 100644 --- a/fs/coredump.c +++ b/fs/coredump.c @@ -1016,7 +1016,9 @@ static const struct ctl_table coredump_sysctls[] = { .data = &core_pipe_limit, .maxlen = sizeof(unsigned int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_INT_MAX, }, { .procname = "core_file_note_size_limit",