The function validates tv_sec to be within [-KTIME_SEC_MAX, KTIME_SEC_MAX] but never validates that tv_nsec is within the valid range of [0, NSEC_PER_SEC-1] before using it in timespec64_add(). timespec64_add() expects both timespec64 structures to have normalized values with tv_nsec in the range [0, 999999999]. If off->val.tv_nsec contains invalid values (negative or >= NSEC_PER_SEC), it could lead to incorrect calculations or unexpected behavior. Add validation to ensure tv_nsec is within the valid range before performing the addition.
Unified · Split
| @@ -293,10 +293,12 @@ int proc_timens_set_offset(struct file *file, struct task_struct *p, · 292 unmodified lines | ||
| 293 | 293 | return -EINVAL; |
| 294 | 294 | } |
| 295 | 295 | |
| 296 | − if (off->val.tv_sec > KTIME_SEC_MAX || | |
| 297 | − off->val.tv_sec < -KTIME_SEC_MAX) | |
| 296 | + if (off->val.tv_sec > KTIME_SEC_MAX || off->val.tv_sec < -KTIME_SEC_MAX) | |
| 298 | 297 | return -ERANGE; |
| 299 | 298 | |
| 299 | + if (off->val.tv_nsec < 0 || off->val.tv_nsec >= NSEC_PER_SEC) | |
| 300 | + return -EINVAL; | |
| 301 | + | |
| 300 | 302 | tp = timespec64_add(tp, off->val); |
| 301 | 303 | /* |
| 302 | 304 | * KTIME_SEC_MAX is divided by 2 to be sure that KTIME_MAX is |