Re: [PATCH 1/2] sysctl: Negate before converting in the int read path

[Bradley Morgan]

On 22 September 2026 04:12:27 BST, Zhan Xusheng <zhanxusheng1024@xxxxxxxxx>
wrote:
>proc_int_k2u_conv_kop() reports the sign through *negp and the magnitude
>through *u_ptr, but for a negative value it hands the sign-extended int to
>the converter and negates the result:
>
>	*u_ptr = k_ptr_op ? -k_ptr_op((ulong)val) : -(ulong)val;
>
>With div_hz() and HZ=1000 a stored -1000 becomes
>(ulong)-1000 / 1000 == 18446744073709550, and negating that wraps:
>
>	# echo -1 > /proc/sys/net/ipv4/tcp_fin_timeout
>	# cat /proc/sys/net/ipv4/tcp_fin_timeout
>	-18428297329635842066
>
>Take the magnitude first and convert that, which is what the open-coded
>version did before commit 2dc164a48e6f ("sysctl: Create converter
>functions with two new macros") folded it into a macro.  The
>k_ptr_op == NULL branch was already correct.
>
>proc_dointvec_jiffies() and proc_dointvec_ms_jiffies() are affected.
>
>Fixes: 2dc164a48e6f ("sysctl: Create converter functions with two new macros")
>Cc: stable@xxxxxxxxxxxxxxx
>Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
>---
> kernel/sysctl.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/kernel/sysctl.c b/kernel/sysctl.c
>index f7b75985d542..38597f26b34c 100644
>--- a/kernel/sysctl.c
>+++ b/kernel/sysctl.c
>@@ -483,7 +483,7 @@ int proc_int_k2u_conv_kop(ulong *u_ptr, const int *k_ptr, bool *negp,
> 
> 	if (val < 0) {
> 		*negp = true;
>-		*u_ptr = k_ptr_op ? -k_ptr_op((ulong)val) : -(ulong)val;
>+		*u_ptr = k_ptr_op ? k_ptr_op(-(ulong)val) : -(ulong)val;
> 	} else {
> 		*negp = false;
> 		*u_ptr = k_ptr_op ? k_ptr_op((ulong)val) : (ulong) val;
>
I didn't do much crazy review here, but I think this LGTM! :)

Reviewed-by: Bradley Morgan <brads@xxxxxxxxxxxxxx>

--- Thanks!
"I'm not a very positive person" - Linus torvalds