Commit 7cc94eaa authored by Justin Stitt's avatar Justin Stitt Committed by Xiongfeng Wang
Browse files

ntp: Safeguard against time_constant overflow 

stable inclusion
from stable-v4.19.320
commit a13f8b269b6f4c9371ab149ecb65d2edb52e9669
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAYQRI
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a13f8b269b6f4c9371ab149ecb65d2edb52e9669



--------------------------------

commit 06c03c8edce333b9ad9c6b207d93d3a5ae7c10c0 upstream.

Using syzkaller with the recently reintroduced signed integer overflow
sanitizer produces this UBSAN report:

UBSAN: signed-integer-overflow in ../kernel/time/ntp.c:738:18
9223372036854775806 + 4 cannot be represented in type 'long'
Call Trace:
 handle_overflow+0x171/0x1b0
 __do_adjtimex+0x1236/0x1440
 do_adjtimex+0x2be/0x740

The user supplied time_constant value is incremented by four and then
clamped to the operating range.

Before commit eea83d89 ("ntp: NTP4 user space bits update") the user
supplied value was sanity checked to be in the operating range. That change
removed the sanity check and relied on clamping after incrementing which
does not work correctly when the user supplied value is in the overflow
zone of the '+ 4' operation.

The operation requires CAP_SYS_TIME and the side effect of the overflow is
NTP getting out of sync.

Similar to the fixups for time_maxerror and time_esterror, clamp the user
space supplied value to the operating range.

[ tglx: Switch to clamping ]

Fixes: eea83d89 ("ntp: NTP4 user space bits update")
Signed-off-by: default avatarJustin Stitt <justinstitt@google.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: Miroslav Lichvar <mlichvar@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20240517-b4-sio-ntp-c-v2-1-f3a80096f36f@google.com
Closes: https://github.com/KSPP/linux/issues/352


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarXiongfeng Wang <wangxiongfeng2@huawei.com>
parent 683da419

kernel/time/ntp.c

+2 −3
Original line number Diff line number Diff line
@@ -692,11 +692,10 @@ static inline void process_adjtimex_modes(const struct timex *txc, s32 *time_tai 
		time_esterror = clamp(txc->esterror, (__kernel_long_t)0, (__kernel_long_t)NTP_PHASE_LIMIT);



	if (txc->modes & ADJ_TIMECONST) {

		time_constant = txc->constant;

		time_constant = clamp(txc->constant, (__kernel_long_t)0, (__kernel_long_t)MAXTC);

		if (!(time_status & STA_NANO))

			time_constant += 4;

		time_constant = min(time_constant, (long)MAXTC);

		time_constant = max(time_constant, 0l);

		time_constant = clamp(time_constant, (long)0, (long)MAXTC);

	}



	if (txc->modes & ADJ_TAI &&