The function validates tv_sec to be within [-KTIME_SEC_MAX, KTIME_SEC_MAX] but never validates that tv_nsec is within the valid range of [0, NSEC_PER_SEC-1] before using it in timespec64_add(). timespec64_add() expects both timespec64 structures to have normalized values with tv_nsec in the range [0, 999999999]. If off->val.tv_nsec contains invalid values (negative or >= NSEC_PER_SEC), it could lead to incorrect calculations or unexpected behavior. Add validation to ensure tv_nsec is within the valid range before performing the addition.
Unified · Split
| @@ -293,10 +293,12 @@ int proc_timens_set_offset(struct file *file, struct task_struct *p, · 292 unmodified lines | |||
| 293 | return -EINVAL; | 293 | return -EINVAL; |
| 294 | } | 294 | } |
| 295 | 295 | ||
| 296 | if (off->val.tv_sec > KTIME_SEC_MAX || | 296 | if (off->val.tv_sec > KTIME_SEC_MAX || off->val.tv_sec < -KTIME_SEC_MAX) |
| 297 | off->val.tv_sec < -KTIME_SEC_MAX) | ||
| 298 | return -ERANGE; | 297 | return -ERANGE; |
| 299 | 298 | ||
| 299 | if (off->val.tv_nsec < 0 || off->val.tv_nsec >= NSEC_PER_SEC) | ||
| 300 | return -EINVAL; | ||
| 301 | |||
| 300 | tp = timespec64_add(tp, off->val); | 302 | tp = timespec64_add(tp, off->val); |
| 301 | /* | 303 | /* |
| 302 | * KTIME_SEC_MAX is divided by 2 to be sure that KTIME_MAX is | 304 | * KTIME_SEC_MAX is divided by 2 to be sure that KTIME_MAX is |