[PATCH] fix for /proc operation:

  I found that 'max' pointer is not updated in proc_dointvec_minmax()
  and proc_doulongvec_minmax(), when I write smaller values than min to
  /proc/sys entry (and val<*min++ check becomes true.)
  This may lead to min/max checking of values with bogus maximum.

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 7869159de04ab0deca86415f90d51094d451a41c..7eb271716af937f2c6eb851b4641bc56653991c3 100644 (file)
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -971,7 +971,7 @@ int proc_dointvec_minmax(ctl_table *table, int write, struct file *filp,
        vleft = table->maxlen / sizeof(int);
        left = *lenp;
        
-       for (; left && vleft--; i++, first=0) {
+       for (; left && vleft--; i++, min++, max++, first=0) {
                if (write) {
                        while (left) {
                                char c;
@@ -1007,9 +1007,7 @@ int proc_dointvec_minmax(ctl_table *table, int write, struct file *filp,
                        buffer += len;
                        left -= len;
 
-                       if (min && val < *min++)
-                               continue;
-                       if (max && val > *max++)
+                       if ((min && val < *min) || (max && val > *max))
                                continue;
                        *i = val;
                } else {
@@ -1074,7 +1072,7 @@ static int do_proc_doulongvec_minmax(ctl_table *table, int write,
        vleft = table->maxlen / sizeof(unsigned long);
        left = *lenp;
        
-       for (; left && vleft--; i++, first=0) {
+       for (; left && vleft--; i++, min++, max++, first=0) {
                if (write) {
                        while (left) {
                                char c;
@@ -1112,9 +1110,7 @@ static int do_proc_doulongvec_minmax(ctl_table *table, int write,
 
                        if(neg)
                                continue;
-                       if (min && val < *min++)
-                               continue;
-                       if (max && val > *max++)
+                       if ((min && val < *min) || (max && val > *max))
                                continue;
                        *i = val;
                } else {