From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751109AbdFTPlx (ORCPT <rfc822;w@1wt.eu>);
        Tue, 20 Jun 2017 11:41:53 -0400
Received: from Galois.linutronix.de ([146.0.238.70]:44936 "EHLO
        Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1750859AbdFTPlv (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 20 Jun 2017 11:41:51 -0400
Message-Id: <20170620153734.970526461@linutronix.de>
User-Agent: quilt/0.63-1
Date: Tue, 20 Jun 2017 17:37:34 +0200
From: Thomas Gleixner <tglx@linutronix.de>
To: LKML <linux-kernel@vger.kernel.org>
Cc: John Stultz <john.stultz@linaro.org>,
        Peter Zijlstra <peterz@infradead.org>, Xishi Qiu <qiuxishi@huawei.com>
Subject: [patch 0/2] timers: Prevent multiplication overflow in timespec/val
 conversions
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

KASAN detected a multiplication overflow in the sys_setitimer() timeval
conversion. The same issue is possible the posix-cpu-timer sys_timer_set()
implementation.

In both cases the conversion of the tv_sec part overflows when multiplied
with NSEC_PER_SEC, i.e. 1e9.

This can be mitigated by using the timespec/val_to_ktime() helper, which
prevents the overflow and clamps the result to KTIME_MAX (~292 years).

Thanks,

	tglx