Pull urgent fixes from John Stultz: Two urgent fixes for user triggerable time related overflow issues
Unified · Split
| @@ -110,6 +110,19 @@ static inline bool timespec_valid_strict(const struct timespec *ts) · 109 unmodified lines | |||
| 110 | return true; | 110 | return true; |
| 111 | } | 111 | } |
| 112 | 112 | ||
| 113 | static inline bool timeval_valid(const struct timeval *tv) | ||
| 114 | { | ||
| 115 | /* Dates before 1970 are bogus */ | ||
| 116 | if (tv->tv_sec < 0) | ||
| 117 | return false; | ||
| 118 | |||
| 119 | /* Can't have more microseconds then a second */ | ||
| 120 | if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC) | ||
| 121 | return false; | ||
| 122 | |||
| 123 | return true; | ||
| 124 | } | ||
| 125 | |||
| 113 | extern struct timespec timespec_trunc(struct timespec t, unsigned gran); | 126 | extern struct timespec timespec_trunc(struct timespec t, unsigned gran); |
| 114 | 127 | ||
| 115 | #define CURRENT_TIME (current_kernel_time()) | 128 | #define CURRENT_TIME (current_kernel_time()) |
| @@ -633,6 +633,13 @@ int ntp_validate_timex(struct timex *txc) · 632 unmodified lines | |||
| 633 | if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME))) | 633 | if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME))) |
| 634 | return -EPERM; | 634 | return -EPERM; |
| 635 | 635 | ||
| 636 | if (txc->modes & ADJ_FREQUENCY) { | ||
| 637 | if (LONG_MIN / PPM_SCALE > txc->freq) | ||
| 638 | return -EINVAL; | ||
| 639 | if (LONG_MAX / PPM_SCALE < txc->freq) | ||
| 640 | return -EINVAL; | ||
| 641 | } | ||
| 642 | |||
| 636 | return 0; | 643 | return 0; |
| 637 | } | 644 | } |
| 638 | 645 | ||
| @@ -196,6 +196,10 @@ SYSCALL_DEFINE2(settimeofday, struct timeval __user *, tv, · 195 unmodified lines | |||
| 196 | if (tv) { | 196 | if (tv) { |
| 197 | if (copy_from_user(&user_tv, tv, sizeof(*tv))) | 197 | if (copy_from_user(&user_tv, tv, sizeof(*tv))) |
| 198 | return -EFAULT; | 198 | return -EFAULT; |
| 199 | |||
| 200 | if (!timeval_valid(&user_tv)) | ||
| 201 | return -EINVAL; | ||
| 202 | |||
| 199 | new_ts.tv_sec = user_tv.tv_sec; | 203 | new_ts.tv_sec = user_tv.tv_sec; |
| 200 | new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC; | 204 | new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC; |
| 201 | } | 205 | } |