Messages in this thread | | | Date | Wed, 26 Nov 2014 14:27:44 -0500 | From | Sasha Levin <> | Subject | Re: [RFC 2/2] kvm: eventfd: detect integer overflow using check_*_overflow |
| |
On 11/26/2014 02:12 PM, Linus Torvalds wrote: >> kernel/time/ntp.c:process_adjtimex_modes(): >> > >> > if (txc->modes & ADJ_FREQUENCY) { >> > time_freq = txc->freq * PPM_SCALE; <=== Undefined overflow >> > time_freq = min(time_freq, MAXFREQ_SCALED); >> > time_freq = max(time_freq, -MAXFREQ_SCALED); >> > /* update pps_freq */ >> > pps_set_freq(time_freq); >> > } >> > >> > The multiplication is between signed integers, and it overflows (user triggerable). > Well, we check that the end result - overflowed or not - is in a sane > range. So this might fall under the heading of "user gets what he asks > for".
I guess, though it wouldn't be clear to the user why it's broken since he passed a seemingly valid looking value for txc->freq.
Thanks, Sasha
| |