[CRIU] Re: [PATCH] kernel: limit a value of ns_last_pid to (0, max_pid)

[Oleg Nesterov]

On 09/04, Andrew Vagin wrote:
>
> The kernel doesn't check pid on a negative values, so if
> you would try to write -2 in /proc/sys/kernel/ns_last_pid,
> you will get a kernel panic.
>
> In this case the next pid is -1, and alloc_pidmap will try to access
> to a nonexistent pidmap.
>
> map = &pid_ns->pidmap[pid/BITS_PER_PAGE];

Yes, alloc_pidmap() assumes that pid_ns->last_pid + 1 is positive...

So ".extra1 = &zero" is not enough, INT_MAX can overflow as well.

>  static struct ctl_table pid_ns_ctl_table[] = {
>  	{
>  		.procname = "ns_last_pid",
>  		.maxlen = sizeof(int),
>  		.mode = 0666, /* permissions are checked in the handler */
>  		.proc_handler = pid_ns_ctl_handler,
> +		.extra1 = &zero,
> +		.extra2 = &pid_max,

Acked-by: Oleg Nesterov <oleg at redhat.com>