Bug 197371

Summary: Possible access to unintended variable in "kernel/sysctl.c" line 1339
Product: Other Reporter: Petru-Florin Mihancea (petrum)
Component: OtherAssignee: other_other
Status: NEW ---    
Severity: enhancement CC: rdunlap
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: Master branch Subsystem:
Regression: No Bisected commit-id:

Description Petru-Florin Mihancea 2017-10-24 10:59:02 UTC 
While experimenting with a CodeSonar plugin we develop, we noticed a
potential inconsistency in file "kernel/sysctl.c" line 1339, initialization of "vm_table" array.

{
    .procname	= "dirtytime_expire_seconds",
    .data	= &dirtytime_expire_interval,
    .maxlen	= sizeof(dirty_expire_interval), //HERE
    .mode	= 0644,
    .proc_handler = dirtytime_interval_handler,
    .extra1	= &zero,
},

Shoudn't "dirtytime_expire_interval" be used instead of "dirty_expire_interval"? Yes, it looks harmless because the variables have the same type. However, the real intention looks to be the usage of sizeof(dirtytime_expire_interval).

Thanks,
Petru Mihancea
Comment 1 Randy Dunlap 2018-03-24 20:57:29 UTC 
Patch posted to linux-kernel mailing list on 2018-03-23 and Cc-ed to Petru.
BTW, you could have just posted a patch for this.