Commit 9176ab1b authored Jul 07, 2019 by zhengbin Committed by Thomas Gleixner Jul 07, 2019

time: Validate user input in compat_settimeofday()



The user value is validated after converting the timeval to a timespec, but
for a wide range of negative tv_usec values the multiplication overflow turns
them in positive numbers. So the 'validated later' is not catching the
invalid input.

Signed-off-by: zhengbin <zhengbin13@huawei.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/1562460701-113301-1-git-send-email-zhengbin13@huawei.com

parent 28ef2db8

kernel/time/time.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -251,6 +251,10 @@ COMPAT_SYSCALL_DEFINE2(settimeofday, struct old_timeval32 __user *, tv,
		if (tv) {
		if (compat_get_timeval(&user_tv, tv))
		return -EFAULT;

		if (!timeval_valid(&user_tv))
		return -EINVAL;

		new_ts.tv_sec = user_tv.tv_sec;
		new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC;
		}

Admin message