lkml.org 
[lkml]   [2012]   [Mar]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 2/2] ntp: Fix integer overflow when setting time
Date
'long secs' was being passed as divisor to div_s64, which accepts a 32bit
divisor. On 64bit machines that value would be trimmed back from 8 bytes
back to 4, allowing a divide by zero when the number is bigger than
(1 << 32) - 1 and all 32 lower bits are 0.

Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
---
kernel/time/ntp.c | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 17fb1b9..c83c228 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -289,7 +289,11 @@ static inline s64 ntp_update_offset_fll(s64 offset64, long secs)

time_status |= STA_MODE;

- return div_s64(offset64 << (NTP_SCALE_SHIFT - SHIFT_FLL), secs);
+ /*
+ * secs is 8 bytes on 64bit systems, which means that it can
+ * wrap around when dividing.
+ */
+ return div64_long(offset64 << (NTP_SCALE_SHIFT - SHIFT_FLL), secs);
}

static void ntp_update_offset(long offset)
--
1.7.8.4


\
 
 \ /
  Last update: 2012-03-15 15:39    [W:0.176 / U:0.648 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site