Re: [PATCH 1/2] sysctl: Negate before converting in the int read path

[Joel Granados]

On Tue, Sep 22, 2026 at 11:12:27AM +0800, Zhan Xusheng wrote:
> proc_int_k2u_conv_kop() reports the sign through *negp and the magnitude
> through *u_ptr, but for a negative value it hands the sign-extended int to
> the converter and negates the result:
> 
> 	*u_ptr = k_ptr_op ? -k_ptr_op((ulong)val) : -(ulong)val;
> 
> With div_hz() and HZ=1000 a stored -1000 becomes
> (ulong)-1000 / 1000 == 18446744073709550, and negating that wraps:
> 
> 	# echo -1 > /proc/sys/net/ipv4/tcp_fin_timeout
> 	# cat /proc/sys/net/ipv4/tcp_fin_timeout
> 	-18428297329635842066
Good catch. I'm testing in sysctl-next.

Would you be up for creating a test for this? It would need to be on top
of the new selftests [1] and it requires you to create a similar
situation to the one you corrected lib/test_sysctl.c.

Best

[1] https://lore.kernel.org/20260914-lklm-sysctl-selftests-v1-1-160d90bf8f3e@xxxxxxxxxx

> 
> Take the magnitude first and convert that, which is what the open-coded
> version did before commit 2dc164a48e6f ("sysctl: Create converter
> functions with two new macros") folded it into a macro.  The
> k_ptr_op == NULL branch was already correct.
> 
> proc_dointvec_jiffies() and proc_dointvec_ms_jiffies() are affected.
> 
> Fixes: 2dc164a48e6f ("sysctl: Create converter functions with two new macros")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
> ---
>  kernel/sysctl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
> index f7b75985d542..38597f26b34c 100644
> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -483,7 +483,7 @@ int proc_int_k2u_conv_kop(ulong *u_ptr, const int *k_ptr, bool *negp,
>  
>  	if (val < 0) {
>  		*negp = true;
> -		*u_ptr = k_ptr_op ? -k_ptr_op((ulong)val) : -(ulong)val;
> +		*u_ptr = k_ptr_op ? k_ptr_op(-(ulong)val) : -(ulong)val;
>  	} else {
>  		*negp = false;
>  		*u_ptr = k_ptr_op ? k_ptr_op((ulong)val) : (ulong) val;
> -- 
> 2.43.0
>

Attachment: signature.asc
Description: PGP signature