From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755170AbbLDDJv (ORCPT ); Thu, 3 Dec 2015 22:09:51 -0500 Received: from userp1040.oracle.com ([156.151.31.81]:48188 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755016AbbLDDJu (ORCPT ); Thu, 3 Dec 2015 22:09:50 -0500 From: Sasha Levin To: john.stultz@linaro.org, tglx@linutronix.de Cc: linux-kernel@vger.kernel.org, Sasha Levin Subject: [PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to avoid overflow Date: Thu, 3 Dec 2015 22:09:31 -0500 Message-Id: <1449198571-21133-1-git-send-email-sasha.levin@oracle.com> X-Mailer: git-send-email 2.5.0 X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Make sure the tv_usec makes sense. We might multiply them later which can cause an overflow and undefined behavior. Signed-off-by: Sasha Levin --- kernel/time/timekeeping.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c index d563c19..aa3c1c2 100644 --- a/kernel/time/timekeeping.c +++ b/kernel/time/timekeeping.c @@ -1987,6 +1987,10 @@ int do_adjtimex(struct timex *txc) if (txc->modes & ADJ_SETOFFSET) { struct timespec delta; + + if (txc->time.tv_usec >= USEC_PER_SEC || txc->time.tv_usec <= -USEC_PER_SEC) + return -EINVAL; + delta.tv_sec = txc->time.tv_sec; delta.tv_nsec = txc->time.tv_usec; if (!(txc->modes & ADJ_NANO)) -- 1.7.10.4