The patch titled Subject: proc_sysctl: fix oops caused by incorrect command parameters has been added to the -mm tree. Its filename is proc_sysctl-fix-oops-caused-by-incorrect-command-parameters.patch

This patch should soon appear at https://ozlabs.org/~akpm/mmots/broken-out/proc_sysctl-fix-oops-caused-by-inc... and later at https://ozlabs.org/~akpm/mmotm/broken-out/proc_sysctl-fix-oops-caused-by-inc...

Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated there every 3-4 working days

------------------------------------------------------ From: Xiaoming Ni nixiaoming@huawei.com Subject: proc_sysctl: fix oops caused by incorrect command parameters

The process_sysctl_arg() does not check whether val is empty before invoking strlen(val). If the command line parameter () is incorrectly configured and val is empty, oops is triggered.

For example: "hung_task_panic=1" is incorrectly written as "hung_task_panic", oops is triggered. The call stack is as follows: Kernel command line: .... hung_task_panic ...... Call trace: __pi_strlen+0x10/0x98 parse_args+0x278/0x344 do_sysctl_args+0x8c/0xfc kernel_init+0x5c/0xf4 ret_from_fork+0x10/0x30

To fix it, check whether "val" is empty when "phram" is a sysctl field. Error codes are returned in the failure branch, and error logs are generated by parse_args().

Link: https://lkml.kernel.org/r/20210118133029.28580-1-nixiaoming@huawei.com Fixes: 3db978d480e2843 ("kernel/sysctl: support setting sysctl parameters from kernel command line") Signed-off-by: Xiaoming Ni nixiaoming@huawei.com Acked-by: Vlastimil Babka vbabka@suse.cz Cc: Luis Chamberlain mcgrof@kernel.org Cc: Kees Cook keescook@chromium.org Cc: Iurii Zaikin yzaikin@google.com Cc: Alexey Dobriyan adobriyan@gmail.com Cc: Michal Hocko mhocko@suse.com Cc: Masami Hiramatsu mhiramat@kernel.org Cc: Heiner Kallweit hkallweit1@gmail.com Cc: Randy Dunlap rdunlap@infradead.org Cc: stable@vger.kernel.org [5.8+] Signed-off-by: Andrew Morton akpm@linux-foundation.org ---

fs/proc/proc_sysctl.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/fs/proc/proc_sysctl.c~proc_sysctl-fix-oops-caused-by-incorrect-command-parameters +++ a/fs/proc/proc_sysctl.c @@ -1770,6 +1770,12 @@ static int process_sysctl_arg(char *para return 0; }

+ if (!val) + return -EINVAL; + len = strlen(val); + if (len == 0) + return -EINVAL; + /* * To set sysctl options, we use a temporary mount of proc, look up the * respective sys/ file and write to it. To avoid mounting it when no @@ -1811,7 +1817,6 @@ static int process_sysctl_arg(char *para file, param, val); goto out; } - len = strlen(val); wret = kernel_write(file, val, len, &pos); if (wret < 0) { err = wret; _

Patches currently in -mm which might be from nixiaoming@huawei.com are

proc_sysctl-fix-oops-caused-by-incorrect-command-parameters.patch