mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, "Ingo Molnar" <mingo@kernel.org>,
	"Thomas Gleixner" <tglx@linutronix.de>,
	"Sasha Levin" <sasha.levin@oracle.com>,
	"John Stultz" <john.stultz@linaro.org>
Subject: [PATCH 3.2 20/24] time: adjtimex: Validate the ADJ_FREQUENCY values
Date: Tue, 03 Mar 2015 22:11:28 +0000	[thread overview]
Message-ID: <lsq.1425420688.328937986@decadent.org.uk> (raw)
In-Reply-To: <lsq.1425420688.806916072@decadent.org.uk>

3.2.68-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Sasha Levin <sasha.levin@oracle.com>

commit 5e5aeb4367b450a28f447f6d5ab57d8f2ab16a5f upstream.

Verify that the frequency value from userspace is valid and makes sense.

Unverified values can cause overflows later on.

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
[jstultz: Fix up bug for negative values and drop redunent cap check]
Signed-off-by: John Stultz <john.stultz@linaro.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 kernel/time/ntp.c | 7 +++++++
 1 file changed, 7 insertions(+)

--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -608,6 +608,13 @@ int do_adjtimex(struct timex *txc)
 			return -EINVAL;
 	}
 
+	if (txc->modes & ADJ_FREQUENCY) {
+		if (LONG_MIN / PPM_SCALE > txc->freq)
+			return -EINVAL;
+		if (LONG_MAX / PPM_SCALE < txc->freq)
+			return -EINVAL;
+	}
+
 	if (txc->modes & ADJ_SETOFFSET) {
 		struct timespec delta;
 		delta.tv_sec  = txc->time.tv_sec;


  parent reply	other threads:[~2015-03-03 23:21 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-03-03 22:11 [PATCH 3.2 00/24] 3.2.68-rc1 review Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 19/24] sched/rt: Reduce rq lock contention by eliminating locking of non-feasible target Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 06/24] lib/checksum.c: fix carry in csum_tcpudp_nofold Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 23/24] ipv6: fib: fix fib dump restart Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 22/24] " Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 11/24] gpio: sysfs: fix memory leak in gpiod_sysfs_set_active_low Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 09/24] MIPS: Fix kernel lockup or crash after CPU offline/online Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 12/24] MIPS: Fix C0_Pagegrain[IEC] support Ben Hutchings
2015-03-03 23:24   ` David Daney
2015-03-04  0:25     ` Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 21/24] ntp: Fixup adjtimex freq validation on 32-bit systems Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 05/24] ALSA: ak411x: Fix stall in work callback Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 14/24] mm: pagewalk: call pte_hole() for VM_PFNMAP during walk_page_range Ben Hutchings
2015-03-03 22:11 ` Ben Hutchings [this message]
2015-03-03 22:11 ` [PATCH 3.2 10/24] gpio: sysfs: fix memory leak in gpiod_export_link Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 07/24] lib/checksum.c: fix build for generic csum_tcpudp_nofold Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 03/24] MIPS: IRQ: Fix disable_irq on CPU IRQs Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 24/24] Bluetooth: ath3k: workaround the compatibility issue with xHCI controller Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 16/24] Drivers: hv: vmbus: incorrect device name is printed when child device is unregistered Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 02/24] x86: mm/fault: Fix semaphore imbalance Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 13/24] net: sctp: fix passing wrong parameter header to param_type2af in sctp_process_param Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 15/24] nilfs2: fix deadlock of segment constructor over I_SYNC flag Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 08/24] caif: remove wrong dev_net_set() call Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 04/24] ASoC: atmel_ssc_dai: fix start event for I2S mode Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 18/24] [media] media/rc: Send sync space information on the lirc device Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 01/24] PCI: quirks: Fix backport of quirk_io() Ben Hutchings
2015-03-03 22:11 ` [PATCH 3.2 17/24] staging: comedi: cb_pcidas64: fix incorrect AI range code handling Ben Hutchings
2015-03-04  0:28 ` [PATCH 3.2 00/24] 3.2.68-rc1 review Ben Hutchings
2015-03-04  1:01 ` Guenter Roeck
2015-03-04  2:09   ` Ben Hutchings

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=lsq.1425420688.328937986@decadent.org.uk \
    --to=ben@decadent.org.uk \
    --cc=akpm@linux-foundation.org \
    --cc=john.stultz@linaro.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@kernel.org \
    --cc=sasha.levin@oracle.com \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®