linux-kernel - Re: [PATCH] drm/etnaviv: only reject timeouts with tv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200121130241.GG25745@shell.armlinux.org.uk>
Date:   Tue, 21 Jan 2020 13:02:42 +0000
From:   Russell King - ARM Linux admin <linux@...linux.org.uk>
To:     Guido Günther <agx@...xcpu.org>
Cc:     Arnd Bergmann <arnd@...db.de>,
        Lucas Stach <l.stach@...gutronix.de>,
        Christian Gmeiner <christian.gmeiner@...il.com>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        Philipp Zabel <p.zabel@...gutronix.de>,
        Sam Ravnborg <sam@...nborg.org>, Rob Herring <robh@...nel.org>,
        Emil Velikov <emil.velikov@...labora.com>,
        etnaviv@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/etnaviv: only reject timeouts with tv_nsec >= 2
 seconds

On Tue, Jan 21, 2020 at 01:55:46PM +0100, Guido Günther wrote:
> Hi,
> On Tue, Jan 21, 2020 at 12:45:25PM +0100, Arnd Bergmann wrote:
> > As Guido Günther reported, get_abs_timeout() in the etnaviv user space
> > sometimes passes timeouts with nanosecond values larger than 1000000000,
> > which gets rejected after my first patch.
> > 
> > To avoid breaking this, while also not allowing completely arbitrary
> > values, set the limit to 1999999999 and use set_normalized_timespec64()
> > to get the correct format before comparing it.
> 
> I'm seeing values up to 5 seconds so I need
> 
>      if (args->timeout.tv_nsec > (5 * NSEC_PER_SEC))

I assume you're looking at 64-bit, but I suspect userspace needs
looking at considering 32-bit.  If userspace uses a 32-bit tv_nsec
anywhere in the path that it attempts to pass up to 5 seconds in
tv_nsec, then this will fail to pass the correct timeout.

If that is the case, userspace is buggy, and needs fixing not to
pass such large values through tv_nsec irrespective of this issue.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 12.1Mbps down 622kbps up
According to speedtest.net: 11.9Mbps down 500kbps up