From nobody Mon Apr 6 09:20:34 2026 Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9579D374746 for ; Thu, 19 Mar 2026 22:51:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773960681; cv=none; b=IPpK6JJdc50y/KJx/u8712FnSl2ZNKCB1lDQeOIbLc3uo8v8Q/+Fsl5b5mHUB2AtRu6lxFnG2Wo4DkyVgUnh66cjqWmcR91xNxpH98vkKifqmSobYg8S22XNte0305Szvon++Fc/FOb9RABaL2znJFzA1lD4oDP9Uxd9z1e5S80= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773960681; c=relaxed/simple; bh=6AfcReJcrJu9WhnO3qul4fSvdhivE/F/gIelzT+OOp8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=qvMHI+LRqgu6UxcP6mBLh/HLhOXatcCOSGaldgQ//onmhulAItc6o8ggIqQEjM9iO00T9SZdUvjgh/owdcj7G59vT0KFu4MJsKg63UevTCJJ7XtMJSwI7H1XoDigVI/SrUAkzZl5XI7SOkGnvjLbD0XahGoL65EF343H7YNwvfk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=lZB4XDab; arc=none smtp.client-ip=209.85.128.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="lZB4XDab" Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-486fd5360d4so8909465e9.1 for ; Thu, 19 Mar 2026 15:51:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20230601; t=1773960679; x=1774565479; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=nUdTNDItYvJjqtgNeFm2LVISlCQh8R6BtBr2HsIhkJ8=; b=lZB4XDabbMIu6AZkaJv2d0lzXbBUEu0VsaxclFKiMIVhNZ1GsNMI1YmLADflY6EpLU nEeYNn2sTvOBcmknhUvJ7nE0FtKKf0hizm+/SVt5GllKEQ6+NadsPXIKnr1fpwhhmBkW cHKI6Dp9CBHBYnHA5dl+Sxs3nkgcu3fnV45ZiuiDROsJZJ/QrrZ3pkLgYvSPWsMYDueU SUIlr6Ek6IO8IoZDuW1I+riuXji5TQvj7u4868LCJTo4IBzFYaWvukeWlqS7qQ8x2AfW CHLH9MMZEeNGWQh0vX4AbSlb/R93w/N4K9Hx8uYhRLirWpsOhPLUawCtnYPuEiOqQI1A AZNg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773960679; x=1774565479; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=nUdTNDItYvJjqtgNeFm2LVISlCQh8R6BtBr2HsIhkJ8=; b=aZTEksxomv8uZdikujzUFchTSh9VAZjwJbD0VECjnuZS7M88d1lPFcDRILU+PGeokn 0MRVpZsGs6PPm01Ah1J7wRO4lRQ+PzX5pYLuybEZN9MEXGKiMyEOBJzShuMDIvIhZDvr F3yqBnn/UYSgjtzeOFswtSJKo7UWuz8PyLR+vL+fgtYlnp35pWFNEqQlOEfnJs/sDNNm ViqFkZaBGI4ejiIQe/iUh3kiS8gbIEwnhtl7adsUsemCpQTf5iF1jQXuVBv08TJSGqV7 G9pWTo5TnDIxtj/g6AAQNrWxr8SOYUrDIx1lNsoRb1ycMVKHYh7m4GKH5o8duzJJm9BV 6V9Q== X-Gm-Message-State: AOJu0YyD13N7uzU9bR6Qm6eNnv3Mec+QAQquhFFW9XLNtYSgeqODJ2yC XzFGkhT63gQLMdo9gZNXYftnYK8UE/DfDIjFgED1G0GKIDLdAQ86ErEn X-Gm-Gg: ATEYQzykXLguBF84r0taja2NqW1YKXfUkCTbkplZcjJc4pEyMLSvdHeXIgRLhY7Vlxq p3RKeYOLVvwPFukyuwW4HiwZMvagBwW0GHt/SFrl/zBDqkFBeqZ9keBQccxTDQ6tW9uJ58KxswT swuDEtWUMsf7oJWMMEiev4Btv7Ki/S8Dtg+VkaE2I3nr31A8IHF2/t/6kZxfZa4jgLV06Jm98Iu 2cZYo++v/tnB4/ywiUxiyObjlUB2gieUdPZk0TkRDnMbQBTieHcImauH0VUgvz2ndOlz/37qhSJ 5nTjlqxJ07shnUrbPz5jrGbjeIxS4voSg5wlHTu+660GSeBQ+O9DuH1aJ30z28YVuLKxExwVhBF wHmG02w23c95HTy44oFPs2Djq7NSfqFrI3PJm4nRsmo0RZkjIhCVrP3iZtnZAm4hzEnHnY8FfQx eY2ch4vmSryPHYwBNIoEe9pMX/EbDF7w== X-Received: by 2002:a05:600c:8b66:b0:486:f9d0:aac8 with SMTP id 5b1f17b1804b1-486fee0f835mr10675735e9.18.1773960678806; Thu, 19 Mar 2026 15:51:18 -0700 (PDT) Received: from [192.168.0.108] ([2a02:8071:5392:3220::bcad]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43b64703c27sm1939156f8f.18.2026.03.19.15.51.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 19 Mar 2026 15:51:18 -0700 (PDT) From: Marc Buerg Date: Thu, 19 Mar 2026 23:50:50 +0100 Subject: [PATCH v3] sysctl: fix check against uninitialized variable in proc_do_large_bitmap Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260319-fix-uninitialized-variable-in-proc_do_large_bitmap-v3-1-9cfc3ff60c09@googlemail.com> X-B4-Tracking: v=1; b=H4sIAMl9vGkC/6XOQQ6CMBAF0KuYrq2hRcC48h7GkKGdwiSlJQUbl XB3CysTd7r8P5P/ZmYjBsKRnXczCxhpJO9SyPc7pjpwLXLSKTOZyTLLheSGHvzuyNFEYOmFmkc IBI1Nl44Pwata+9pCaLFuaOph4HmmSjRHUEIVLA0PAdPKhl5vKXc0Tj48tx+iWNu/uCi44HkBW mqtwUhxab1vLfZA9qB8z1Yzyk+n+smRySm1aQSgAXmqvpxlWd6MTwHDYQEAAA== X-Change-ID: 20260312-fix-uninitialized-variable-in-proc_do_large_bitmap-30c6ef4ac1c5 To: Kees Cook , Joel Granados , "David S. Miller" , Octavian Purdila Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, Elias Oezcan , Peter Seiderer , Marc Buerg X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1773960677; l=3294; i=buermarc@googlemail.com; s=20260312; h=from:subject:message-id; bh=6AfcReJcrJu9WhnO3qul4fSvdhivE/F/gIelzT+OOp8=; b=ImgvJ6Afc9p3uliV3Aeh619/GJK7s2SFbVzkHeiK5D6PGb3oiKxJNUvLo9eEhGin6Gq7dUnUB swsDwJt+CweCKqvVtEy/stfLP2he1SdO26mr+xUHTM7vxs6bwAtE2KO X-Developer-Key: i=buermarc@googlemail.com; a=ed25519; pk=kBZIEGh9yNUzqCz87kygF7XqwPxTWvwm4+HUrOuckyM= proc_do_large_bitmap() does not initialize variable c, which is expected to be set to a trailing character by proc_get_long(). However, proc_get_long() only sets c when the input buffer contains a trailing character after the parsed value. If c is not initialized it may happen to contain a '-'. If this is the case proc_do_large_bitmap() expects to be able to parse a second part of the input buffer. If there is no second part an unjustified -EINVAL will be returned. Add check that left is non-zero before checking c, as proc_get_long() ensures that the passed left is non-zero, if a trailing character exists. Reviewed-by: Peter Seiderer --- When writing to /proc/sys/net/ipv4/ip_local_reserved_ports it is possible to receive an -EINVAL for a valid value. This happens due to a check of a potentially uninitialized variable in the proc_do_large_bitmap() function, namely char c. To trigger this behavior the variable has to contain the later explicitly checked '-' char by chance. In proc_do_large_bitmap() it is expected that the variable might be filled by the proc_get_long() function with the trailing character of the given input. But only if a trailing character exists within the passed size of the buffer. If no trailing character is present we still do a c =3D=3D '-' check. If the uninitialized variable contains this char the function continues parsing. It will now set err to -EINVAL in the next proc_get_long() call, as there is nothing more to parse. proc_do_large_bitmap() passes left to the proc_get_long() call. left will only be non-zero, if a trailing character has been written. Therefore, checking that left is non-zero before accessing c fixes this problem. The problem will only arise sporadically, as the variable must contain '-' by chance. On the affected system CONFIG_INIT_STACK_NONE=3Dy was enabled. Further, when enabling eBPF tracing to dump contents of the stack the issue disappeared. Fixes: 9f977fb7ae9d ("sysctl: add proc_do_large_bitmap") Signed-off-by: Marc Buerg Reviewed-by: Peter Seiderer --- Changes in v3: - Add Reviewed-by: Peter Seiderer - Re-include bug context into cover letter - Link to v2: https://lore.kernel.org/r/20260317-fix-uninitialized-variable= -in-proc_do_large_bitmap-v2-1-6dfb1aefa287@googlemail.com Changes in v2: - Drop initialization of c to 0 - Include checking that left is non-zero before checking against c - Link to v1: https://lore.kernel.org/r/20260312-fix-uninitialized-variable= -in-proc_do_large_bitmap-v1-1-35ad2dddaf21@googlemail.com --- kernel/sysctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 9d3a666ffde1..dd337a63da41 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1171,7 +1171,7 @@ int proc_do_large_bitmap(const struct ctl_table *tabl= e, int dir, left--; } =20 - if (c =3D=3D '-') { + if (left && c =3D=3D '-') { err =3D proc_get_long(&p, &left, &val_b, &neg, tr_b, sizeof(tr_b), &c); --- base-commit: 80234b5ab240f52fa45d201e899e207b9265ef91 change-id: 20260312-fix-uninitialized-variable-in-proc_do_large_bitmap-30c6= ef4ac1c5 Best regards, --=20 buermarc