MFC r283491:

Properly check tv_nsec value. The tv_nsec field can also be one
of the special value UTIME_NOW or UTIME_OMIT.

1 files changed, 16 insertions, 2 deletions

diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c
index 1c626ad..d87d786 100644
--- a/sys/compat/linux/linux_misc.c
+++ b/sys/compat/linux/linux_misc.c
@@ -139,6 +139,9 @@ struct l_pselect6arg {
 	l_size_t	ss_len;
 };
 
+static int	linux_utimensat_nsec_valid(l_long);
+
+
 int
 linux_sysinfo(struct thread *td, struct linux_sysinfo_args *args)
 {
@@ -823,6 +826,17 @@ linux_utimes(struct thread *td, struct linux_utimes_args *args)
 	return (error);
 }
 
+static int
+linux_utimensat_nsec_valid(l_long nsec)
+{
+
+	if (nsec == LINUX_UTIME_OMIT || nsec == LINUX_UTIME_NOW)
+		return (0);
+	if (nsec >= 0 && nsec <= 999999999)
+		return (0);
+	return (1);
+}
+
 int 
 linux_utimensat(struct thread *td, struct linux_utimensat_args *args)
 {
@@ -846,8 +860,8 @@ linux_utimensat(struct thread *td, struct linux_utimensat_args *args)
 		if (error != 0)
 			return (error);
 
-		if (l_times[0].tv_nsec > 999999999 ||
-			l_times[1].tv_nsec > 999999999)
+		if (linux_utimensat_nsec_valid(l_times[0].tv_nsec) != 0 ||
+		    linux_utimensat_nsec_valid(l_times[1].tv_nsec) != 0)
 			return (EINVAL);
 
 		times[0].tv_sec = l_times[0].tv_sec;