From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D2514149C50; Tue, 25 Jun 2024 09:38:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719308309; cv=none; b=WE4DHoSoun2OPEWLw9eFxhAFn18xt4Yk309pzRPtkfK0y/7T8KPBr1mUXwpGHnaG6XtYchGRuL3sBY9pNkCzmDx5XU6ciSGR6lkhCJZ3CVJPfZPKGqfOMVD4N7C+VlgUrikkQ1xTJXKj6uhXBsjAg+pU9uGN9YWpn7DQr4KHLTA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719308309; c=relaxed/simple; bh=VgvAqSo3QGlLFBQ3tfyc6YwuzvFa5l0Fxs6ViaFTuVE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LJ9CxQOskVvwfBQxbeFQcVb8CYHAv8IlESqdZCytrvWtjT1CqA/Naj7ktQdOC/aoUfeb8BPlVNhnb8qEC4YttROcTSD7lZ8S9S/eIAtqAOVoWwLfnpJjfPwYHqhPpvBYZsXLR8yYfY9wf3yvXhfNOwx5HWhZhiIDTamG/nJ75HY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ejHLj9/Z; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ejHLj9/Z" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18307C32781; Tue, 25 Jun 2024 09:38:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1719308309; bh=VgvAqSo3QGlLFBQ3tfyc6YwuzvFa5l0Fxs6ViaFTuVE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ejHLj9/Zxz9+1NP/EJDaPuSDziTf470Ljgv7do+64ab6EAtQ54L6LZHnb1qv0n9kZ 1hD5zP4SXW1V69Tz7xl/zi92Dm7zt0PEl+BxpaxZnNq/XRUppWeqcsOEUnx70NY6P2 Z1trpYI8+gxeFw6+HjLV7/XAAwxvCIR87xPwDt+E= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jan Kara , Roman Smirnov , Sergey Shtylyov , Sasha Levin Subject: [PATCH 6.9 078/250] udf: udftime: prevent overflow in udf_disk_stamp_to_time() Date: Tue, 25 Jun 2024 11:30:36 +0200 Message-ID: <20240625085551.059542226@linuxfoundation.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240625085548.033507125@linuxfoundation.org> References: <20240625085548.033507125@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Roman Smirnov [ Upstream commit 3b84adf460381169c085e4bc09e7b57e9e16db0a ] An overflow can occur in a situation where src.centiseconds takes the value of 255. This situation is unlikely, but there is no validation check anywere in the code. Found by Linux Verification Center (linuxtesting.org) with Svace. Suggested-by: Jan Kara Signed-off-by: Roman Smirnov Reviewed-by: Sergey Shtylyov Signed-off-by: Jan Kara Message-Id: <20240327132755.13945-1-r.smirnov@omp.ru> Signed-off-by: Sasha Levin --- fs/udf/udftime.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fs/udf/udftime.c b/fs/udf/udftime.c index 758163af39c26..78ecc633606fb 100644 --- a/fs/udf/udftime.c +++ b/fs/udf/udftime.c @@ -46,13 +46,18 @@ udf_disk_stamp_to_time(struct timespec64 *dest, struct timestamp src) dest->tv_sec = mktime64(year, src.month, src.day, src.hour, src.minute, src.second); dest->tv_sec -= offset * 60; - dest->tv_nsec = 1000 * (src.centiseconds * 10000 + - src.hundredsOfMicroseconds * 100 + src.microseconds); + /* * Sanitize nanosecond field since reportedly some filesystems are * recorded with bogus sub-second values. */ - dest->tv_nsec %= NSEC_PER_SEC; + if (src.centiseconds < 100 && src.hundredsOfMicroseconds < 100 && + src.microseconds < 100) { + dest->tv_nsec = 1000 * (src.centiseconds * 10000 + + src.hundredsOfMicroseconds * 100 + src.microseconds); + } else { + dest->tv_nsec = 0; + } } void -- 2.43.0