linux-kernel - Re: [PATCH] time: Fix overwrite err unexpected in clock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210412141950.GA18311@hoboy.vegasvil.org>
Date:   Mon, 12 Apr 2021 07:19:50 -0700
From:   Richard Cochran <richardcochran@...il.com>
To:     Chen Jun <chenjun102@...wei.com>
Cc:     linux-kernel@...r.kernel.org, tglx@...utronix.de,
        johnstul@...ibm.com, rui.xiang@...wei.com
Subject: Re: [PATCH] time: Fix overwrite err unexpected in clock_adjtime32

On Mon, Apr 12, 2021 at 12:45:51PM +0000, Chen Jun wrote:
> the correct error is covered by put_old_timex32.

Well, the non-negative return code (TIME_OK, TIME_INS, etc) is
clobbered by put_old_timex32().

> Fixes: f1f1d5ebd10f ("posix-timers: Introduce a syscall for clock tuning.")

This is not the correct commit for the "Fixes" tag.  Please find the
actual commit that introduced the issue.

In commit f1f1d5ebd10f the code looked like this...

	long compat_sys_clock_adjtime(clockid_t which_clock,
			struct compat_timex __user *utp)
	{
		struct timex txc;
		mm_segment_t oldfs;
		int err, ret;
	
		err = compat_get_timex(&txc, utp);
		if (err)
			return err;
	
		oldfs = get_fs();
		set_fs(KERNEL_DS);
		ret = sys_clock_adjtime(which_clock, (struct timex __user *) &txc);
		set_fs(oldfs);
	
		err = compat_put_timex(utp, &txc);
		if (err)
			return err;
	
		return ret;
	}

Thanks,
Richard



> Signed-off-by: Chen Jun <chenjun102@...wei.com>
> ---
>  kernel/time/posix-timers.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
> index bf540f5a..dd5697d 100644
> --- a/kernel/time/posix-timers.c
> +++ b/kernel/time/posix-timers.c
> @@ -1191,8 +1191,8 @@ SYSCALL_DEFINE2(clock_adjtime32, clockid_t, which_clock,
>  
>  	err = do_clock_adjtime(which_clock, &ktx);
>  
> -	if (err >= 0)
> -		err = put_old_timex32(utp, &ktx);
> +	if (err >= 0 && put_old_timex32(utp, &ktx))
> +		return -EFAULT;
>  
>  	return err;
>  }
> -- 
> 2.9.4
>