kernel/sysctl.c: detect overflows when converting to int

[cascardo/linux.git] / kernel / sysctl.c

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 3c09984..2082b1a 100644 (file)
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1981,7 +1981,15 @@ static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp,
                                 int write, void *data)
 {
        if (write) {
-               *valp = *negp ? -*lvalp : *lvalp;
+               if (*negp) {
+                       if (*lvalp > (unsigned long) INT_MAX + 1)
+                               return -EINVAL;
+                       *valp = -*lvalp;
+               } else {
+                       if (*lvalp > (unsigned long) INT_MAX)
+                               return -EINVAL;
+                       *valp = *lvalp;
+               }
        } else {
                int val = *valp;
                if (val < 0) {