Commit d7adf328 authored by Lukas Hannen's avatar Lukas Hannen Committed by liwei
Browse files

time: Handle negative seconds correctly in timespec64_to_ns() 

mainline inclusion
from mainline-v5.15-rc1
commit 39ff83f2
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8MCB5


CVE: NA

---------------------------

timespec64_ns() prevents multiplication overflows by comparing the seconds
value of the timespec to KTIME_SEC_MAX. If the value is greater or equal it
returns KTIME_MAX.

But that check casts the signed seconds value to unsigned which makes the
comparision true for all negative values and therefore return wrongly
KTIME_MAX.

Negative second values are perfectly valid and required in some places,
e.g. ptp_clock_adjtime().

Remove the cast and add a check for the negative boundary which is required
to prevent undefined behaviour due to multiplication underflow.

Fixes: cb477557 ("time: Prevent undefined behaviour in timespec64_to_ns()")'
Signed-off-by: default avatarLukas Hannen <lukas.hannen@opensource.tttech-industrial.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/AM6PR01MB541637BD6F336B8FFB72AF80EEC69@AM6PR01MB5416.eurprd01.prod.exchangelabs.com


Signed-off-by: default avatarliwei <liwei728@huawei.com>
parent 9b8b6ad3

include/linux/time64.h

+7 −2
Original line number Diff line number Diff line
@@ -39,7 +39,9 @@ struct itimerspec64 { 
/* Located here for timespec[64]_valid_strict */

#define TIME64_MAX			((s64)~((u64)1 << 63))

#define KTIME_MAX			((s64)~((u64)1 << 63))

#define KTIME_MIN			(-KTIME_MAX - 1)

#define KTIME_SEC_MAX			(KTIME_MAX / NSEC_PER_SEC)

#define KTIME_SEC_MIN			(KTIME_MIN / NSEC_PER_SEC)



/*

 * Limits for settimeofday():
@@ -140,10 +142,13 @@ static inline bool timespec64_valid_settod(const struct timespec64 *ts) 
 */

static inline s64 timespec64_to_ns(const struct timespec64 *ts)

{

	/* Prevent multiplication overflow */

	if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)

	/* Prevent multiplication overflow / underflow */

	if (ts->tv_sec >= KTIME_SEC_MAX)

		return KTIME_MAX;



	if (ts->tv_sec <= KTIME_SEC_MIN)

		return KTIME_MIN;



	return ((s64) ts->tv_sec * NSEC_PER_SEC) + ts->tv_nsec;

}