[UBUNTU oem-5.14, jammy, oem-5.17, kinetic, oem-6.0, unstable 2/2] proc: avoid integer type confusion in get_proc_long

[Thadeu Lima de Souza Cascardo]

From: Linus Torvalds <torvalds at linux-foundation.org>

proc_get_long() is passed a size_t, but then assigns it to an 'int'
variable for the length.  Let's not do that, even if our IO paths are
limited to MAX_RW_COUNT (exactly because of these kinds of type errors).

So do the proper test in the rigth type.

Reported-by: Kyle Zeng <zengyhkyle at gmail.com>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
(cherry picked from commit e6cfaf34be9fcd1a8285a294e18986bfc41a409c)
CVE-2022-4378
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at canonical.com>
---
 kernel/sysctl.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index bb5fd3455723..09e0e804de72 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -344,13 +344,12 @@ static int proc_get_long(char **buf, size_t *size,
 			  unsigned long *val, bool *neg,
 			  const char *perm_tr, unsigned perm_tr_len, char *tr)
 {
-	int len;
 	char *p, tmp[TMPBUFLEN];
+	ssize_t len = *size;
 
-	if (!*size)
+	if (len <= 0)
 		return -EINVAL;
 
-	len = *size;
 	if (len > TMPBUFLEN - 1)
 		len = TMPBUFLEN - 1;
 
-- 
2.34.1