lkml.org 
[lkml]   [2019]   [Dec]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 226/267] ppdev: fix PPGETTIME/PPSETTIME ioctls
    Date
    From: Arnd Bergmann <arnd@arndb.de>

    commit 998174042da229e2cf5841f574aba4a743e69650 upstream.

    Going through the uses of timeval in the user space API,
    I noticed two bugs in ppdev that were introduced in the y2038
    conversion:

    * The range check was accidentally moved from ppsettime to
    ppgettime

    * On sparc64, the microseconds are in the other half of the
    64-bit word.

    Fix both, and mark the fix for stable backports.

    Cc: stable@vger.kernel.org
    Fixes: 3b9ab374a1e6 ("ppdev: convert to y2038 safe")
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Link: https://lore.kernel.org/r/20191108203435.112759-8-arnd@arndb.de
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/char/ppdev.c | 16 ++++++++++++----
    1 file changed, 12 insertions(+), 4 deletions(-)

    --- a/drivers/char/ppdev.c
    +++ b/drivers/char/ppdev.c
    @@ -623,20 +623,27 @@ static int pp_do_ioctl(struct file *file
    if (copy_from_user(time32, argp, sizeof(time32)))
    return -EFAULT;

    + if ((time32[0] < 0) || (time32[1] < 0))
    + return -EINVAL;
    +
    return pp_set_timeout(pp->pdev, time32[0], time32[1]);

    case PPSETTIME64:
    if (copy_from_user(time64, argp, sizeof(time64)))
    return -EFAULT;

    + if ((time64[0] < 0) || (time64[1] < 0))
    + return -EINVAL;
    +
    + if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall())
    + time64[1] >>= 32;
    +
    return pp_set_timeout(pp->pdev, time64[0], time64[1]);

    case PPGETTIME32:
    jiffies_to_timespec64(pp->pdev->timeout, &ts);
    time32[0] = ts.tv_sec;
    time32[1] = ts.tv_nsec / NSEC_PER_USEC;
    - if ((time32[0] < 0) || (time32[1] < 0))
    - return -EINVAL;

    if (copy_to_user(argp, time32, sizeof(time32)))
    return -EFAULT;
    @@ -647,8 +654,9 @@ static int pp_do_ioctl(struct file *file
    jiffies_to_timespec64(pp->pdev->timeout, &ts);
    time64[0] = ts.tv_sec;
    time64[1] = ts.tv_nsec / NSEC_PER_USEC;
    - if ((time64[0] < 0) || (time64[1] < 0))
    - return -EINVAL;
    +
    + if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall())
    + time64[1] <<= 32;

    if (copy_to_user(argp, time64, sizeof(time64)))
    return -EFAULT;

    \
     
     \ /
      Last update: 2019-12-16 19:00    [W:4.044 / U:0.676 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site