Xiaoming Ni cb5fe25c82 proc_sysctl: fix oops caused by incorrect command parameters ...

commit 697edcb0e4 upstream.

The process_sysctl_arg() does not check whether val is empty before
invoking strlen(val).  If the command line parameter () is incorrectly
configured and val is empty, oops is triggered.

For example:
  "hung_task_panic=1" is incorrectly written as "hung_task_panic", oops is
  triggered. The call stack is as follows:
    Kernel command line: .... hung_task_panic
    ......
    Call trace:
    __pi_strlen+0x10/0x98
    parse_args+0x278/0x344
    do_sysctl_args+0x8c/0xfc
    kernel_init+0x5c/0xf4
    ret_from_fork+0x10/0x30

To fix it, check whether "val" is empty when "phram" is a sysctl field.
Error codes are returned in the failure branch, and error logs are
generated by parse_args().

Link: https://lkml.kernel.org/r/20210118133029.28580-1-nixiaoming@huawei.com
Fixes: 3db978d480 ("kernel/sysctl: support setting sysctl parameters from kernel command line")
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Iurii Zaikin <yzaikin@google.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Heiner Kallweit <hkallweit1@gmail.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: <stable@vger.kernel.org>	[5.8+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-01-27 11:55:14 +01:00

..

array.c

seccomp: Report number of loaded filters in /proc/$pid/status

2020-07-10 16:01:51 -07:00

base.c

exec: Transform exec_update_mutex into a rw_semaphore

2021-01-09 13:46:24 +01:00

bootconfig.c

proc/bootconfig: Fix to use correct quotes for value

2020-06-16 21:21:03 -04:00

cmdline.c

…

consoles.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 191

2019-05-30 11:29:21 -07:00

cpuinfo.c

proc/cpuinfo: switch to ->read_iter

2020-11-06 10:05:18 -08:00

devices.c

block: move block-related definitions out of fs.h

2020-06-24 09:16:02 -06:00

fd.c

…

fd.h

…

generic.c

proc: fix lookup in /proc/net subdirectories after setns(2)

2020-12-30 11:53:56 +01:00

inode.c

proc: wire up generic_file_splice_read for iter ops

2020-11-06 10:05:18 -08:00

internal.h

proc: fix lookup in /proc/net subdirectories after setns(2)

2020-12-30 11:53:56 +01:00

interrupts.c

…

Kconfig

treewide: replace '---help---' in Kconfig files with 'help'

2020-06-14 01:57:21 +09:00

kcore.c

maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault

2020-06-17 10:57:41 -07:00

kmsg.c

proc: faster open/read/close with "permanent" files

2020-04-07 10:43:42 -07:00

loadavg.c

sched: loadavg: consolidate LOAD_INT, LOAD_FRAC, CALC_LOAD

2018-10-26 16:26:32 -07:00

Makefile

proc: bootconfig: Add /proc/bootconfig to show boot config list

2020-01-13 13:19:39 -05:00

meminfo.c

proc/meminfo: avoid open coded reading of vm_committed_as

2020-08-07 11:33:26 -07:00

namespaces.c

Merge branch 'work.openat2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2020-01-29 11:20:24 -08:00

nommu.c

mm: don't include asm/pgtable.h if linux/mm.h is already included

2020-06-09 09:39:13 -07:00

page.c

mm: Add PG_arch_2 page flag

2020-09-04 12:46:06 +01:00

proc_net.c

proc: fix lookup in /proc/net subdirectories after setns(2)

2020-12-30 11:53:56 +01:00

proc_sysctl.c

proc_sysctl: fix oops caused by incorrect command parameters

2021-01-27 11:55:14 +01:00

proc_tty.c

…

root.c

proc: s_fs_info may be NULL when proc_kill_sb is called

2020-06-10 14:54:54 -05:00

self.c

proc: don't allow async path resolution of /proc/self components

2020-11-13 16:47:52 -07:00

softirqs.c

…

stat.c

proc/stat: switch to ->read_iter

2020-11-06 10:05:18 -08:00

task_mmu.c

mm: don't play games with pinned pages in clear_page_refs

2021-01-19 18:27:29 +01:00

task_nommu.c

mmap locking API: use coccinelle to convert mmap_sem rwsem call sites

2020-06-09 09:39:14 -07:00

thread_self.c

proc: Use new_inode not new_inode_pseudo

2020-06-12 14:13:33 -05:00

uptime.c

fs/proc: Respect boottime inside time namespace for /proc/uptime

2020-01-14 12:20:56 +01:00

util.c

fs/proc/util.c: include fs/proc/internal.h for name_to_int()

2019-01-04 13:13:45 -08:00

version.c

…

vmcore.c

mm: don't include asm/pgtable.h if linux/mm.h is already included

2020-06-09 09:39:13 -07:00