From: Artur Molchanov arturmolchanov@gmail.com
mainline inclusion from mainline-5.10-rc1 commit c09f56b8f68d4d536bff518227aea323b835b2ce category: bugfix bugzilla: 51817 CVE: NA
------------------------------------------------- Fix returning value for sysctl sunrpc.transports. Return error code from sysctl proc_handler function proc_do_xprt instead of number of the written bytes. Otherwise sysctl returns random garbage for this key.
Since v1: - Handle negative returned value from memory_read_from_buffer as an error
Signed-off-by: Artur Molchanov arturmolchanov@gmail.com Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields bfields@redhat.com (cherry picked from commit c09f56b8f68d4d536bff518227aea323b835b2ce) Signed-off-by: Baisong Zhong zhongbaisong@huawei.com Reviewed-by: Yue Haibing yuehaibing@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- net/sunrpc/sysctl.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c index 0bea8ff8b0d38..c39b90ac24020 100644 --- a/net/sunrpc/sysctl.c +++ b/net/sunrpc/sysctl.c @@ -69,7 +69,13 @@ static int proc_do_xprt(struct ctl_table *table, int write, return 0; } len = svc_print_xprts(tmpbuf, sizeof(tmpbuf)); - return simple_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len); + *lenp = simple_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len); + + if (*lenp < 0) { + *lenp = 0; + return -EINVAL; + } + return 0; }
static int