[PATCH] time: verify time values in adjtimex ADJ_SETOFFSET to avoid overflow

Sasha Levin
2015-12-04T03:09:51Z

Make sure the tv_usec makes sense. We might multiply them later which can
cause an overflow and undefined behavior.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
---
kernel/time/timekeeping.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index d563c19..aa3c1c2 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -1987,6 +1987,10 @@ int do_adjtimex(struct timex *txc)

if (txc->modes & ADJ_SETOFFSET) {
struct timespec delta;
+
+ if (txc->time.tv_usec >= USEC_PER_SEC || txc->time.tv_usec <= -USEC_PER_SEC)
+ return -EINVAL;
+
delta.tv_sec = txc->time.tv_sec;
delta.tv_nsec = txc->time.tv_usec;
if (!(txc->modes & ADJ_NANO))
--
1.7.10.4