Pull urgent fixes from John Stultz: Two urgent fixes for user triggerable time related overflow issues
Showing the changes to kernel (2 of 3 files). Show all
Unified · Split
| @@ -633,6 +633,13 @@ int ntp_validate_timex(struct timex *txc) · 632 unmodified lines | ||
| 633 | 633 | if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME))) |
| 634 | 634 | return -EPERM; |
| 635 | 635 | |
| 636 | + if (txc->modes & ADJ_FREQUENCY) { | |
| 637 | + if (LONG_MIN / PPM_SCALE > txc->freq) | |
| 638 | + return -EINVAL; | |
| 639 | + if (LONG_MAX / PPM_SCALE < txc->freq) | |
| 640 | + return -EINVAL; | |
| 641 | + } | |
| 642 | + | |
| 636 | 643 | return 0; |
| 637 | 644 | } |
| 638 | 645 | |
| @@ -196,6 +196,10 @@ SYSCALL_DEFINE2(settimeofday, struct timeval __user *, tv, · 195 unmodified lines | ||
| 196 | 196 | if (tv) { |
| 197 | 197 | if (copy_from_user(&user_tv, tv, sizeof(*tv))) |
| 198 | 198 | return -EFAULT; |
| 199 | + | |
| 200 | + if (!timeval_valid(&user_tv)) | |
| 201 | + return -EINVAL; | |
| 202 | + | |
| 199 | 203 | new_ts.tv_sec = user_tv.tv_sec; |
| 200 | 204 | new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC; |
| 201 | 205 | } |