linux-kernel - [PATCH] select: deal with math overflow from borderline valid userland data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20081025124747.5de4d8e7@infradead.org>
Date:	Sat, 25 Oct 2008 12:47:47 -0700
From:	Arjan van de Ven <arjan@...radead.org>
To:	torvalds@...ux-foundation.com
Cc:	"Carlos R. Mafra" <crmafra2@...il.com>,
	Marcin Slusarz <marcin.slusarz@...il.com>,
	linux-kernel@...r.kernel.org, "Rafael J. Wysocki" <rjw@...k.pl>,
	tglx@...x.de, mingo@...e.hu
Subject: [PATCH] select: deal with math overflow from borderline valid
 userland data

Hi Linus,

please apply this patch, it fixes a regression in 2.6.28-rc1.



>From fdaacc0a980f5d323a21610f7f75b2e92470172e Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@...ux.intel.com>
Date: Sat, 25 Oct 2008 12:41:41 -0700
Subject: [PATCH] select: deal with math overflow from borderline valid userland data

Some userland apps seem to pass in a "0" for the seconds, and several
seconds worth of usecs to select(). The old kernels accepted this just
fine, so the new kernels must too.
However, due to the upscaling of the microseconds to nanoseconds we had
some cases where we got math overflow, and depending on the GCC version
(due to inlining decisions) that actually resulted in an -EINVAL return.

This patch fixes this by adding the excess microseconds to the seconds field.

Also with thanks to Marcin Slusarz for spotting some implementation bugs
in the diagnostics patches.

Reported-by: Carlos R. Mafra <crmafra2@...il.com>
Signed-off-by: Arjan van de Ven <arjan@...ux.intel.com>
---
 fs/compat.c |    5 +++--
 fs/select.c |    5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/compat.c b/fs/compat.c
index fe3c9bf..1510879 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1684,8 +1684,9 @@ asmlinkage long compat_sys_select(int n, compat_ulong_t __user *inp,
 			return -EFAULT;
 
 		to = &end_time;
-		if (poll_select_set_timeout(to, tv.tv_sec,
-					    tv.tv_usec * NSEC_PER_USEC))
+		if (poll_select_set_timeout(to, 
+				tv.tv_sec + (tv.tv_usec / USEC_PER_SEC),
+				(tv.tv_usec % USEC_PER_SEC) * NSEC_PER_USEC))
 			return -EINVAL;
 	}
 
diff --git a/fs/select.c b/fs/select.c
index 448e440..7fc3124 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -519,8 +519,9 @@ asmlinkage long sys_select(int n, fd_set __user *inp, fd_set __user *outp,
 			return -EFAULT;
 
 		to = &end_time;
-		if (poll_select_set_timeout(to, tv.tv_sec,
-					    tv.tv_usec * NSEC_PER_USEC))
+		if (poll_select_set_timeout(to, 
+				tv.tv_sec + (tv.tv_usec / USEC_PER_SEC),
+				(tv.tv_usec % USEC_PER_SEC) * NSEC_PER_USEC))
 			return -EINVAL;
 	}
 
-- 
1.5.6.5


-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/