diff options
| author | John Stultz <john.stultz@linaro.org> | 2015-12-03 22:09:31 -0500 |
|---|---|---|
| committer | John Stultz <john.stultz@linaro.org> | 2015-12-10 22:41:06 -0800 |
| commit | 37cf4dc3370fbca0344e23bb96446eb2c3548ba7 (patch) | |
| tree | dcefd17bfae395e3f40e4ddf7e9478e3f1bbe94c /kernel | |
| parent | 52d189f1b38810b1b483d5bac2e4fa90b9afd372 (diff) | |
| download | op-kernel-dev-37cf4dc3370fbca0344e23bb96446eb2c3548ba7.zip op-kernel-dev-37cf4dc3370fbca0344e23bb96446eb2c3548ba7.tar.gz | |
time: Verify time values in adjtimex ADJ_SETOFFSET to avoid overflow
For adjtimex()'s ADJ_SETOFFSET, make sure the tv_usec value is
sane. We might multiply them later which can cause an overflow
and undefined behavior.
This patch introduces new helper functions to simplify the
checking code and adds comments to clarify
Orginally this patch was by Sasha Levin, but I've basically
rewritten it, so he should get credit for finding the issue
and I should get the blame for any mistakes made since.
Also, credit to Richard Cochran for the phrasing used in the
comment for what is considered valid here.
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/time/ntp.c | 10 | ||||
| -rw-r--r-- | kernel/time/timekeeping.c | 2 |
2 files changed, 9 insertions, 3 deletions
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c index 125fc03..4073c95 100644 --- a/kernel/time/ntp.c +++ b/kernel/time/ntp.c @@ -676,8 +676,14 @@ int ntp_validate_timex(struct timex *txc) return -EINVAL; } - if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME))) - return -EPERM; + if (txc->modes & ADJ_SETOFFSET) { + /* In order to inject time, you gotta be super-user! */ + if (!capable(CAP_SYS_TIME)) + return -EPERM; + + if (!timeval_inject_offset_valid(&txc->time)) + return -EINVAL; + } /* * Check for potential multiplication overflows that can diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c index 99188ee..d9249da 100644 --- a/kernel/time/timekeeping.c +++ b/kernel/time/timekeeping.c @@ -958,7 +958,7 @@ int timekeeping_inject_offset(struct timespec *ts) struct timespec64 ts64, tmp; int ret = 0; - if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC) + if (!timespec_inject_offset_valid(ts)) return -EINVAL; ts64 = timespec_to_timespec64(*ts); |
