Messages in this thread Patch in this message | | | From | Sasha Levin <> | Subject | [PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to avoid overflow | Date | Thu, 3 Dec 2015 22:09:31 -0500 |
| |
Make sure the tv_usec makes sense. We might multiply them later which can cause an overflow and undefined behavior.
Signed-off-by: Sasha Levin <sasha.levin@oracle.com> --- kernel/time/timekeeping.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c index d563c19..aa3c1c2 100644 --- a/kernel/time/timekeeping.c +++ b/kernel/time/timekeeping.c @@ -1987,6 +1987,10 @@ int do_adjtimex(struct timex *txc) if (txc->modes & ADJ_SETOFFSET) { struct timespec delta; + + if (txc->time.tv_usec >= USEC_PER_SEC || txc->time.tv_usec <= -USEC_PER_SEC) + return -EINVAL; + delta.tv_sec = txc->time.tv_sec; delta.tv_nsec = txc->time.tv_usec; if (!(txc->modes & ADJ_NANO)) -- 1.7.10.4
| |