linux-kernel - [tip: timers/urgent] ntp: Remove invalid cast in time offset math

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <173279207753.412.15377961196958450230.tip-bot2@tip-bot2>
Date: Thu, 28 Nov 2024 11:07:57 -0000
From: "tip-bot2 for Marcelo Dalmas" <tip-bot2@...utronix.de>
To: linux-tip-commits@...r.kernel.org
Cc: Marcelo Dalmas <marcelo.dalmas@...com>,
 Thomas Gleixner <tglx@...utronix.de>, stable@...r.kernel.org, x86@...nel.org,
 linux-kernel@...r.kernel.org
Subject: [tip: timers/urgent] ntp: Remove invalid cast in time offset math

The following commit has been merged into the timers/urgent branch of tip:

Commit-ID:     f5807b0606da7ac7c1b74a386b22134ec7702d05
Gitweb:        https://git.kernel.org/tip/f5807b0606da7ac7c1b74a386b22134ec7702d05
Author:        Marcelo Dalmas <marcelo.dalmas@...com>
AuthorDate:    Mon, 25 Nov 2024 12:16:09 
Committer:     Thomas Gleixner <tglx@...utronix.de>
CommitterDate: Thu, 28 Nov 2024 12:02:38 +01:00

ntp: Remove invalid cast in time offset math

Due to an unsigned cast, adjtimex() returns the wrong offest when using
ADJ_MICRO and the offset is negative. In this case a small negative offset
returns approximately 4.29 seconds (~ 2^32/1000 milliseconds) due to the
unsigned cast of the negative offset.

This cast was added when the kernel internal struct timex was changed to
use type long long for the time offset value to address the problem of a
64bit/32bit division on 32bit systems.

The correct cast would have been (s32), which is correct as time_offset can
only be in the range of [INT_MIN..INT_MAX] because the shift constant used
for calculating it is 32. But that's non-obvious.

Remove the cast and use div_s64() to cure the issue.

[ tglx: Fix white space damage, use div_s64() and amend the change log ]

Fixes: ead25417f82e ("timex: use __kernel_timex internally")
Signed-off-by: Marcelo Dalmas <marcelo.dalmas@...com>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: stable@...r.kernel.org
Link: https://lore.kernel.org/all/SJ0P101MB03687BF7D5A10FD3C49C51E5F42E2@SJ0P101MB0368.NAMP101.PROD.OUTLOOK.COM
---
 kernel/time/ntp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index b550ebe..163e7a2 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -798,7 +798,7 @@ int __do_adjtimex(struct __kernel_timex *txc, const struct timespec64 *ts,

 		txc->offset = shift_right(ntpdata->time_offset * NTP_INTERVAL_FREQ, NTP_SCALE_SHIFT);
 		if (!(ntpdata->time_status & STA_NANO))
-			txc->offset = (u32)txc->offset / NSEC_PER_USEC;
+			txc->offset = div_s64(txc->offset, NSEC_PER_USEC);
 	}

 	result = ntpdata->time_state;