git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 1352df9b2a0d6898ff7777618c1fc1b7284958bf Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Tue, 1 Sep 2020 17:30:13 +0800
   4 Subject: time: Prevent undefined behaviour in timespec64_to_ns()
   5
   6 From: Zeng Tao <prime.zeng@hisilicon.com>
   7
   8 [ Upstream commit cb47755725da7b90fecbb2aa82ac3b24a7adb89b ]
   9
  10 UBSAN reports:
  11
  12 Undefined behaviour in ./include/linux/time64.h:127:27
  13 signed integer overflow:
  14 17179869187 * 1000000000 cannot be represented in type 'long long int'
  15 Call Trace:
  16  timespec64_to_ns include/linux/time64.h:127 [inline]
  17  set_cpu_itimer+0x65c/0x880 kernel/time/itimer.c:180
  18  do_setitimer+0x8e/0x740 kernel/time/itimer.c:245
  19  __x64_sys_setitimer+0x14c/0x2c0 kernel/time/itimer.c:336
  20  do_syscall_64+0xa1/0x540 arch/x86/entry/common.c:295
  21
  22 Commit bd40a175769d ("y2038: itimer: change implementation to timespec64")
  23 replaced the original conversion which handled time clamping correctly with
  24 timespec64_to_ns() which has no overflow protection.
  25
  26 Fix it in timespec64_to_ns() as this is not necessarily limited to the
  27 usage in itimers.
  28
  29 [ tglx: Added comment and adjusted the fixes tag ]
  30
  31 Fixes: 361a3bf00582 ("time64: Add time64.h header and define struct timespec64")
  32 Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
  33 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  34 Reviewed-by: Arnd Bergmann <arnd@arndb.de>
  35 Cc: stable@vger.kernel.org
  36 Link: https://lore.kernel.org/r/1598952616-6416-1-git-send-email-prime.zeng@hisilicon.com
  37 Signed-off-by: Sasha Levin <sashal@kernel.org>
  38 ---
  39  include/linux/time64.h | 4 ++++
  40  1 file changed, 4 insertions(+)
  41
  42 diff --git a/include/linux/time64.h b/include/linux/time64.h
  43 index 980c71b3001a5..2a45b8c87edbf 100644
  44 --- a/include/linux/time64.h
  45 +++ b/include/linux/time64.h
  46 @@ -188,6 +188,10 @@ static inline bool timespec64_valid_strict(const struct timespec64 *ts)
  47   */
  48  static inline s64 timespec64_to_ns(const struct timespec64 *ts)
  49  {
  50 +       /* Prevent multiplication overflow */
  51 +       if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
  52 +               return KTIME_MAX;
  53 +
  54         return ((s64) ts->tv_sec * NSEC_PER_SEC) + ts->tv_nsec;
  55  }
  56
  57 --
  58 2.27.0
  59