[RFC][PATCH -reworked] time: Verify time values in adjtimex ADJ_SETOFFSET to avoid overflow

Path	csiph.com!news.mixmin.net!eternal-september.org!feeder.eternal-september.org!aioe.org!bofh.it!news.nic.it!robomod
From	John Stultz <john.stultz@linaro.org>
Newsgroups	linux.kernel
Subject	[RFC][PATCH -reworked] time: Verify time values in adjtimex ADJ_SETOFFSET to avoid overflow
Date	Mon, 07 Dec 2015 21:20:01 +0100
Message-ID	<qDaql-PS-3@gated-at.bofh.it> (permalink)
References	<qDa70-st-17@gated-at.bofh.it>
X-Original-To	lkml <linux-kernel@vger.kernel.org>
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro-org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=wWgjZil6VAMUTC7Mf385nB7XZBH1W1irOLLiIx3bbJc=; b=XwjUJGi2IQ1uytKKzRm5sFATF0pxtYTBAENuJd20oOmI/a6iteUj4d6vWffM7g9Woy jgaoRoqE7BmiD117zZuVANOcjLe6kSns9S2xW1miZ5n6TCI4WB+GRCMC2uci0FbA4+4b RmK9DSPA4Eq4yu/fOEhDtwNA73pzSKVJvjbXyNsdOhiGwx7CCARzbjTKiCEgDrQf6jfW Y2+foqAGgc64xNTsTiY42bd/EK/OftsXG+MPJRycKkBKmG9TOH8FwJ21f4QLz2GJTf6/ HxDUCh7JNc+GRpMdIoPtPPMRSPCKz39tQGBXOE7KtYIQoR0vsU5Z7n+wBxLz0Xtbdoa3 Jq3Q==
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=wWgjZil6VAMUTC7Mf385nB7XZBH1W1irOLLiIx3bbJc=; b=ka8a5pzu4Bmw1uGH2XELQ+STKapvaiDt3qGIW8h9JvjTn8yU2XNfKFa0VMvA2oxfZT emdUKlCeVl67opghvLdDboqutB9IcOSA0qH/w+3c7NjDu2qdX1kdf+WcXjfBWtIjj03Y pf/Z45qqERsiARIX657zuny8M68RA3ZBjy2Wx65e9+4CF/IQLwH79zJYOv4OobgVFDWV f4bW1/SBM56VxhPPTimGg+e6jIhVlm+ftVGgosfUsaXx/FBqyh/vSrZ9uX8R79EmCYXa liYDhS6tUg5YpbvIvYjiJki3aE0UlYIpW7p+60otigO7p6gDvoX305iP5Mx0fmKdQITa 9iaA==
X-Gm-Message-State	ALoCoQlwoN1fnHkNMR8PHRPLTqkAl66ENJD4Sa8YLDRBxMuSNi9CJJrtXn6LGLqECr8w+zKaN4ft
X-Received	by 10.98.9.194 with SMTP id 63mr46289696pfj.30.1449519127923; Mon, 07 Dec 2015 12:12:07 -0800 (PST)
X-Mailer	git-send-email 1.9.1
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	67
Organization	linux.* mail to news gateway
X-Original-Cc	Sasha Levin <sasha.levin@oracle.com>, Richard Cochran <richardcochran@gmail.com>, Thomas Gleixner <tglx@linutronix.de>, John Stultz <john.stultz@linaro.org>
X-Original-Date	Mon, 7 Dec 2015 12:11:58 -0800
X-Original-Message-ID	<1449519118-4950-1-git-send-email-john.stultz@linaro.org>
X-Original-References	<CALAqxLU1c+hLHyKMgM4EFaNUN-Y2Kcj6O08DngcSpy1DZ_487Q@mail.gmail.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1285893

Show key headers only | View raw

From: Sasha Levin <sasha.levin@oracle.com>

Make sure the tv_usec makes sense. We might multiply them later which can
cause an overflow and undefined behavior.

Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>,
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
[jstultz: Moved corrected check to ntp_validate_timex]
Signed-off-by: John Stultz <john.stultz@linaro.org>
---
Here's my attempt at reworking the patch.
Let me know if you have any thoughts or objections.
thanks
-john


 kernel/time/ntp.c         | 14 ++++++++++++--
 kernel/time/timekeeping.c |  1 +
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 36616c3..e9a1874 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -676,8 +676,18 @@ int ntp_validate_timex(struct timex *txc)
 			return -EINVAL;
 	}
 
-	if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME)))
-		return -EPERM;
+	if (txc->modes & ADJ_SETOFFSET) {
+		/* In order to inject time, you gotta be super-user! */
+		if (!capable(CAP_SYS_TIME))
+			return -EPERM;
+
+		/*
+		 * tv_sec can be positive or negative, but usec
+		 * must be positive and from 0->USEC_PER_SEC
+		 */
+		if (txc->time.tv_usec >= USEC_PER_SEC)
+			return -EINVAL;
+	}
 
 	/*
 	 * Check for potential multiplication overflows that can
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 99188ee..a37222b 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -1986,6 +1986,7 @@ int do_adjtimex(struct timex *txc)
 
 	if (txc->modes & ADJ_SETOFFSET) {
 		struct timespec delta;
+
 		delta.tv_sec  = txc->time.tv_sec;
 		delta.tv_nsec = txc->time.tv_usec;
 		if (!(txc->modes & ADJ_NANO))
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to avoid overflow Sasha Levin <sasha.levin@oracle.com> - 2015-12-04 04:20 +0100
  Re: [PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to  avoid overflow John Stultz <john.stultz@linaro.org> - 2015-12-04 21:30 +0100
  Re: [PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to  avoid overflow Thomas Gleixner <tglx@linutronix.de> - 2015-12-05 18:20 +0100
    Re: [PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to  avoid overflow Sasha Levin <sasha.levin@oracle.com> - 2015-12-06 01:20 +0100
      Re: [PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to  avoid overflow Thomas Gleixner <tglx@linutronix.de> - 2015-12-06 10:10 +0100
        Re: [PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to  avoid overflow Richard Cochran <richardcochran@gmail.com> - 2015-12-06 23:20 +0100
          Re: [PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to  avoid overflow John Stultz <john.stultz@linaro.org> - 2015-12-07 21:00 +0100
            Re: [RFC][PATCH -reworked] time: Verify time values in adjtimex  ADJ_SETOFFSET to avoid overflow John Stultz <john.stultz@linaro.org> - 2015-12-07 21:20 +0100
              Re: [RFC][PATCH -reworked] time: Verify time values in adjtimex  ADJ_SETOFFSET to avoid overflow Thomas Gleixner <tglx@linutronix.de> - 2015-12-07 21:20 +0100
            [RFC][PATCH -reworked] time: Verify time values in adjtimex ADJ_SETOFFSET to avoid overflow John Stultz <john.stultz@linaro.org> - 2015-12-07 21:20 +0100
            Re: [PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to  avoid overflow Thomas Gleixner <tglx@linutronix.de> - 2015-12-07 21:20 +0100
              Re: [PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to  avoid overflow John Stultz <john.stultz@linaro.org> - 2015-12-07 21:20 +0100
              Re: [PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to  avoid overflow John Stultz <john.stultz@linaro.org> - 2015-12-07 21:30 +0100

csiph-web