From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DE5A51BA882; Wed, 5 Jun 2024 11:55:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717588522; cv=none; b=Nutpb4Ta9Cqhl66bYLfm7BR94IaE7AFG7TKgFl1T0LYsv01+oryj37sLM5jDAx4IP9acuQWRgpaBCfETXsousNPiEjzboZy/eCxBUamEcTkZ/dX0RzcEBoYdp3k73oybaJ4AGKzEWlzek3jRCWLGMmII7RZqrgQoCOG5diIp9jc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717588522; c=relaxed/simple; bh=vZPl2Rg9MMjHgwCnAcC6p7mvcU/vcb8ipMfTFMNDETU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KaqdxrFEPzNgaZ2geMHiJ61Zdz/4nVq8qZx6tE3CK7oYLvWn2gU8HQUeGHhvQVyhIqlcgLkOpZ049FTUqynJ+GkITRofmcLtglQj7SEwBsaPG0by0j3zWIUKX/oTjFxztnieR2iQbTnqY86o5x15wh8H8H4rMKxRYlE9olDb7+o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KiNR6jl8; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KiNR6jl8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F271EC32786; Wed, 5 Jun 2024 11:55:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1717588521; bh=vZPl2Rg9MMjHgwCnAcC6p7mvcU/vcb8ipMfTFMNDETU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KiNR6jl8vm78FoYfg30mzAwmjl7R4CyOEoKr3kMu9JN0X3M345jPcVSmckWESk62z r6NsJayu2gUCRY+8/i1euvW98jjmvYcouPWEu42cWrq7YwXgQDxcCf9b0ubLPKDr01 L4nWFwRFek+fPhPH/igiANsaLfbIyJyQVW+YUwHxzFcC65Gw+tuOYF5NmuN3xepApT ILa6zxqjGj71e/bpylwhVHCcjibBFLzEUpUa+L6UafIgmevvdvzPHW9EUGIVFGXAsl m7QUvs88F/02/6C6quDV+8xpul8PrmtbRqm98OkIjRxnimviXr9sa9AWSmTUCbH1DV W6ES4tsBzpYng== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Roman Smirnov , Jan Kara , Sergey Shtylyov , Sasha Levin , jack@suse.com Subject: [PATCH AUTOSEL 4.19 2/4] udf: udftime: prevent overflow in udf_disk_stamp_to_time() Date: Wed, 5 Jun 2024 07:55:10 -0400 Message-ID: <20240605115518.2964670-2-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240605115518.2964670-1-sashal@kernel.org> References: <20240605115518.2964670-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 4.19.315 Content-Transfer-Encoding: 8bit From: Roman Smirnov [ Upstream commit 3b84adf460381169c085e4bc09e7b57e9e16db0a ] An overflow can occur in a situation where src.centiseconds takes the value of 255. This situation is unlikely, but there is no validation check anywere in the code. Found by Linux Verification Center (linuxtesting.org) with Svace. Suggested-by: Jan Kara Signed-off-by: Roman Smirnov Reviewed-by: Sergey Shtylyov Signed-off-by: Jan Kara Message-Id: <20240327132755.13945-1-r.smirnov@omp.ru> Signed-off-by: Sasha Levin --- fs/udf/udftime.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fs/udf/udftime.c b/fs/udf/udftime.c index fce4ad976c8c2..26169b1f482c3 100644 --- a/fs/udf/udftime.c +++ b/fs/udf/udftime.c @@ -60,13 +60,18 @@ udf_disk_stamp_to_time(struct timespec64 *dest, struct timestamp src) dest->tv_sec = mktime64(year, src.month, src.day, src.hour, src.minute, src.second); dest->tv_sec -= offset * 60; - dest->tv_nsec = 1000 * (src.centiseconds * 10000 + - src.hundredsOfMicroseconds * 100 + src.microseconds); + /* * Sanitize nanosecond field since reportedly some filesystems are * recorded with bogus sub-second values. */ - dest->tv_nsec %= NSEC_PER_SEC; + if (src.centiseconds < 100 && src.hundredsOfMicroseconds < 100 && + src.microseconds < 100) { + dest->tv_nsec = 1000 * (src.centiseconds * 10000 + + src.hundredsOfMicroseconds * 100 + src.microseconds); + } else { + dest->tv_nsec = 0; + } } void -- 2.43.0