summaryrefslogtreecommitdiffstats
path: root/kernel/time/ntp.c
diff options
context:
space:
mode:
authorJohn Stultz <john.stultz@linaro.org>2015-12-03 22:09:31 -0500
committerJohn Stultz <john.stultz@linaro.org>2015-12-10 22:41:06 -0800
commit37cf4dc3370fbca0344e23bb96446eb2c3548ba7 (patch)
treedcefd17bfae395e3f40e4ddf7e9478e3f1bbe94c /kernel/time/ntp.c
parent52d189f1b38810b1b483d5bac2e4fa90b9afd372 (diff)
downloadlinux-37cf4dc3370fbca0344e23bb96446eb2c3548ba7.tar.gz
linux-37cf4dc3370fbca0344e23bb96446eb2c3548ba7.tar.bz2
linux-37cf4dc3370fbca0344e23bb96446eb2c3548ba7.zip
time: Verify time values in adjtimex ADJ_SETOFFSET to avoid overflow
For adjtimex()'s ADJ_SETOFFSET, make sure the tv_usec value is sane. We might multiply them later which can cause an overflow and undefined behavior. This patch introduces new helper functions to simplify the checking code and adds comments to clarify Orginally this patch was by Sasha Levin, but I've basically rewritten it, so he should get credit for finding the issue and I should get the blame for any mistakes made since. Also, credit to Richard Cochran for the phrasing used in the comment for what is considered valid here. Cc: Sasha Levin <sasha.levin@oracle.com> Cc: Richard Cochran <richardcochran@gmail.com> Cc: Thomas Gleixner <tglx@linutronix.de> Reported-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: John Stultz <john.stultz@linaro.org>
Diffstat (limited to 'kernel/time/ntp.c')
-rw-r--r--kernel/time/ntp.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 125fc0342355..4073c9550af9 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -676,8 +676,14 @@ int ntp_validate_timex(struct timex *txc)
return -EINVAL;
}
- if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME)))
- return -EPERM;
+ if (txc->modes & ADJ_SETOFFSET) {
+ /* In order to inject time, you gotta be super-user! */
+ if (!capable(CAP_SYS_TIME))
+ return -EPERM;
+
+ if (!timeval_inject_offset_valid(&txc->time))
+ return -EINVAL;
+ }
/*
* Check for potential multiplication overflows that can