[PATCH] sysctl: Fix large millisecond-to-jiffies conversions

[PATCH] sysctl: Fix large millisecond-to-jiffies conversions

[Avi Weiss]

sysctl_msecs_to_jiffies() compares the input against
jiffies_to_msecs(MAX_JIFFY_OFFSET), which returns an unsigned int.
When the converted limit exceeds UINT_MAX, it is truncated, causing
valid timeouts to be incorrectly saturated to MAX_JIFFY_OFFSET.
For example, on 32-bit systems with HZ=100, writing 2147483647 ms
stores 1073741822 jiffies instead of 214748365.

For unsigned long sysctls, values between INT_MAX and UINT_MAX
are passed to msecs_to_jiffies(), which interprets them as negative
timeouts. On 64-bit systems with HZ=1000, writing 2147483648 ms
stores MAX_JIFFY_OFFSET instead of 2147483648 jiffies.

Keep the existing conversion for values up to INT_MAX, and use
overflow-safe, full-width arithmetic for larger values. Clamp
the result to MAX_JIFFY_OFFSET.

Fixes: afdf35cfae0d ("sysctl: Fix type truncation in sysctl_msec_to_jiffies")
Fixes: b96b5c6708ea ("sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
 kernel/time/jiffies.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
index af1c69bf0c23..7b02cc7de15e 100644
--- a/kernel/time/jiffies.c
+++ b/kernel/time/jiffies.c
@@ -139,9 +139,20 @@ static int sysctl_k2u_int_conv_userhz(bool *negp, ulong *u_ptr, const int *k_ptr
 
 static ulong sysctl_msecs_to_jiffies(const ulong val)
 {
-	if (val > jiffies_to_msecs(MAX_JIFFY_OFFSET))
-		return MAX_JIFFY_OFFSET;
-	return msecs_to_jiffies(val);
+	ulong secs, jif;
+
+	if (val <= INT_MAX) {
+		jif = msecs_to_jiffies(val);
+	} else {
+		secs = val / MSEC_PER_SEC;
+		if (secs > MAX_JIFFY_OFFSET / HZ)
+			return MAX_JIFFY_OFFSET;
+
+		jif = secs * HZ +
+		      DIV_ROUND_UP((val % MSEC_PER_SEC) * HZ, MSEC_PER_SEC);
+	}
+
+	return min_t(ulong, jif, MAX_JIFFY_OFFSET);
 }
 
 static int sysctl_u2k_int_conv_ms(const bool *negp, const ulong *u_ptr, int *k_ptr)

base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e
-- 
2.43.0