Re: Programs die when max_map_count is too large

[AmÃrico Wang]

On Fri, Nov 27, 2009 at 12:48 AM, Alexey Dobriyan <adobriyan@xxxxxxxxx> wrote:
>> IMO, the problem is 'sysctl_max_map_count' is actually signed int,
>> while when writing to it, the value is treated as unsigned.
>
> The problem is the loop in simple_strtoul(), some people were so afraid
> to touch so they even came up with strict_* variants.
>
>> A better fix which I could imagine is to fix sysctl to understand
>> signed int's.
>
> Â Â Â Â- Â Â Â int map_count;
> Â Â Â Â+ Â Â Â unsigned int map_count;
>
> This is incomplete at least.
>

Yeah, perhaps.

I got a better fix, but only for max_map_count. Please check it below.

(Sorr for attatching it, gmail's IMAP sucks.)

----------------->

Make negative values for 'max_map_count' invalid, they are meaningless.
And avoid overflow.

I already tested this.

Signed-off-by: WANG Cong <xiyou.wangcong@xxxxxxxxx>
-------
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 0d949c5..212360e 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1245,7 +1245,8 @@ static struct ctl_table vm_table[] = {
 		.data		= &sysctl_max_map_count,
 		.maxlen		= sizeof(sysctl_max_map_count),
 		.mode		= 0644,
-		.proc_handler	= &proc_dointvec
+		.proc_handler	= &proc_dointvec_minmax,
+		.extra1		= &zero,
 	},
 #else
 	{