Re: [PATCH 1/2] sysctl: Negate before converting in the int read path

[Bradley Morgan]

On 23 September 2026 14:07:11 BST, Joel Granados <joel.granados@xxxxxxxxxx>
wrote:
>On Tue, Sep 22, 2026 at 07:37:57AM +0100, Bradley Morgan wrote:
>> On 22 September 2026 04:12:27 BST, Zhan Xusheng
><zhanxusheng1024@xxxxxxxxx>
>> wrote:
>> >proc_int_k2u_conv_kop() reports the sign through *negp and the
>magnitude
>> >through *u_ptr, but for a negative value it hands the sign-extended int
>to
>> >the converter and negates the result:
>> >
>> >	*u_ptr = k_ptr_op ? -k_ptr_op((ulong)val) : -(ulong)val;
>> >
>> >With div_hz() and HZ=1000 a stored -1000 becomes
>> >(ulong)-1000 / 1000 == 18446744073709550, and negating that wraps:
>> >
>> >	# echo -1 > /proc/sys/net/ipv4/tcp_fin_timeout
>> >	# cat /proc/sys/net/ipv4/tcp_fin_timeout
>> >	-18428297329635842066
>> >
>> >Take the magnitude first and convert that, which is what the open-coded
>> >version did before commit 2dc164a48e6f ("sysctl: Create converter
>> >functions with two new macros") folded it into a macro.  The
>> >k_ptr_op == NULL branch was already correct.
>> >
>> >proc_dointvec_jiffies() and proc_dointvec_ms_jiffies() are affected.
>> >
>> >Fixes: 2dc164a48e6f ("sysctl: Create converter functions with two new
>macros")
>> >Cc: stable@xxxxxxxxxxxxxxx
>> >Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
>> >---
>> > kernel/sysctl.c | 2 +-
>> > 1 file changed, 1 insertion(+), 1 deletion(-)
>> >
>> >diff --git a/kernel/sysctl.c b/kernel/sysctl.c
>> >index f7b75985d542..38597f26b34c 100644
>> >--- a/kernel/sysctl.c
>> >+++ b/kernel/sysctl.c
>> >@@ -483,7 +483,7 @@ int proc_int_k2u_conv_kop(ulong *u_ptr, const int
>*k_ptr, bool *negp,
>> > 
>> > 	if (val < 0) {
>> > 		*negp = true;
>> >-		*u_ptr = k_ptr_op ? -k_ptr_op((ulong)val) : -(ulong)val;
>> >+		*u_ptr = k_ptr_op ? k_ptr_op(-(ulong)val) : -(ulong)val;
>> > 	} else {
>> > 		*negp = false;
>> > 		*u_ptr = k_ptr_op ? k_ptr_op((ulong)val) : (ulong) val;
>> >
>> I didn't do much crazy review here, but I think this LGTM! :)
>
>If you didn't do much, please don't send the mail.

I said "crazy review" which means I scrolled through it, looked at the
code a bit, and thought it LGTM, I suggested doing acked bys for
situationslike this but maintainers hated that so I just say what I did? 

I usually commentate it all if I did crazy review.

>
>> 
>> Reviewed-by: Bradley Morgan <brads@xxxxxxxxxxxxxx>
>> 
>> --- Thanks!
>> "I'm not a very positive person" - Linus torvalds
>

--- Thanks!
"I'm not a very positive person" - Linus torvalds