Pull urgent fixes from John Stultz: Two urgent fixes for user triggerable time related overflow issues
Unified · Split
| @@ -110,6 +110,19 @@ static inline bool timespec_valid_strict(const struct timespec *ts) · 109 unmodified lines | ||
| 110 | 110 | return true; |
| 111 | 111 | } |
| 112 | 112 | |
| 113 | +static inline bool timeval_valid(const struct timeval *tv) | |
| 114 | +{ | |
| 115 | + /* Dates before 1970 are bogus */ | |
| 116 | + if (tv->tv_sec < 0) | |
| 117 | + return false; | |
| 118 | + | |
| 119 | + /* Can't have more microseconds then a second */ | |
| 120 | + if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC) | |
| 121 | + return false; | |
| 122 | + | |
| 123 | + return true; | |
| 124 | +} | |
| 125 | + | |
| 113 | 126 | extern struct timespec timespec_trunc(struct timespec t, unsigned gran); |
| 114 | 127 | |
| 115 | 128 | #define CURRENT_TIME (current_kernel_time()) |
| @@ -633,6 +633,13 @@ int ntp_validate_timex(struct timex *txc) · 632 unmodified lines | ||
| 633 | 633 | if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME))) |
| 634 | 634 | return -EPERM; |
| 635 | 635 | |
| 636 | + if (txc->modes & ADJ_FREQUENCY) { | |
| 637 | + if (LONG_MIN / PPM_SCALE > txc->freq) | |
| 638 | + return -EINVAL; | |
| 639 | + if (LONG_MAX / PPM_SCALE < txc->freq) | |
| 640 | + return -EINVAL; | |
| 641 | + } | |
| 642 | + | |
| 636 | 643 | return 0; |
| 637 | 644 | } |
| 638 | 645 | |
| @@ -196,6 +196,10 @@ SYSCALL_DEFINE2(settimeofday, struct timeval __user *, tv, · 195 unmodified lines | ||
| 196 | 196 | if (tv) { |
| 197 | 197 | if (copy_from_user(&user_tv, tv, sizeof(*tv))) |
| 198 | 198 | return -EFAULT; |
| 199 | + | |
| 200 | + if (!timeval_valid(&user_tv)) | |
| 201 | + return -EINVAL; | |
| 202 | + | |
| 199 | 203 | new_ts.tv_sec = user_tv.tv_sec; |
| 200 | 204 | new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC; |
| 201 | 205 | } |