mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-21 01:51:18 +00:00
ntp: Safeguard against time_constant overflow
commit06c03c8edc
upstream. Using syzkaller with the recently reintroduced signed integer overflow sanitizer produces this UBSAN report: UBSAN: signed-integer-overflow in ../kernel/time/ntp.c:738:18 9223372036854775806 + 4 cannot be represented in type 'long' Call Trace: handle_overflow+0x171/0x1b0 __do_adjtimex+0x1236/0x1440 do_adjtimex+0x2be/0x740 The user supplied time_constant value is incremented by four and then clamped to the operating range. Before commiteea83d896e
("ntp: NTP4 user space bits update") the user supplied value was sanity checked to be in the operating range. That change removed the sanity check and relied on clamping after incrementing which does not work correctly when the user supplied value is in the overflow zone of the '+ 4' operation. The operation requires CAP_SYS_TIME and the side effect of the overflow is NTP getting out of sync. Similar to the fixups for time_maxerror and time_esterror, clamp the user space supplied value to the operating range. [ tglx: Switch to clamping ] Fixes:eea83d896e
("ntp: NTP4 user space bits update") Signed-off-by: Justin Stitt <justinstitt@google.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Miroslav Lichvar <mlichvar@redhat.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20240517-b4-sio-ntp-c-v2-1-f3a80096f36f@google.com Closes: https://github.com/KSPP/linux/issues/352 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
726f4c241e
commit
ae5848cb5b
1 changed files with 2 additions and 3 deletions
|
@ -733,11 +733,10 @@ static inline void process_adjtimex_modes(const struct __kernel_timex *txc,
|
|||
time_esterror = clamp(txc->esterror, 0, NTP_PHASE_LIMIT);
|
||||
|
||||
if (txc->modes & ADJ_TIMECONST) {
|
||||
time_constant = txc->constant;
|
||||
time_constant = clamp(txc->constant, 0, MAXTC);
|
||||
if (!(time_status & STA_NANO))
|
||||
time_constant += 4;
|
||||
time_constant = min(time_constant, (long)MAXTC);
|
||||
time_constant = max(time_constant, 0l);
|
||||
time_constant = clamp(time_constant, 0, MAXTC);
|
||||
}
|
||||
|
||||
if (txc->modes & ADJ_TAI &&
|
||||
|
|
Loading…
Reference in a new issue