From patchwork Wed Aug 8 19:36:20 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Stultz X-Patchwork-Id: 10599 Return-Path: X-Original-To: patchwork@peony.canonical.com Delivered-To: patchwork@peony.canonical.com Received: from fiordland.canonical.com (fiordland.canonical.com [91.189.94.145]) by peony.canonical.com (Postfix) with ESMTP id A56BC23E40 for ; Wed, 8 Aug 2012 19:36:41 +0000 (UTC) Received: from mail-gh0-f180.google.com (mail-gh0-f180.google.com [209.85.160.180]) by fiordland.canonical.com (Postfix) with ESMTP id 595B1A18190 for ; Wed, 8 Aug 2012 19:36:41 +0000 (UTC) Received: by ghbg10 with SMTP id g10so1206070ghb.11 for ; Wed, 08 Aug 2012 12:36:40 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-forwarded-to:x-forwarded-for:delivered-to:received-spf:from:to:cc :subject:date:message-id:x-mailer:x-content-scanned:x-cbid :x-gm-message-state; bh=xya2LwRe2f33ZuLuPyUZwIYdr2hfLADPibANc3FSliI=; b=nhxM31Lp9AazuDoXv90wl5ZiIQ5NCO2HtNRaAPj19kUsBEnlXTnDRYp7Vt1+GaxXjB zOK366FI3pvNl/qGEgdeA3EjJGWgs+jN6n9JoWBijzVpSBDhyjLg92MbuZyGQbJLysj1 +k2FZ7FWE5dKaq9lO9f/EqAMX92OhH7pZFG80h9tHWqTvTkMdCieF5iWE2ApK15/nweH EyehkDD0M7KElPjfIbVKweZdkJsCZk9Hf8KFTq47SqA8XKS6++/8pAWH+rPRMCTxmOwQ 6GEi5gPPyP+6Tq7gr2onGMvCYiQfcx9ucNGK7t0XFAnTw7AjhWF4pXkt01GH85sEwXk7 i9/w== Received: by 10.42.75.73 with SMTP id z9mr14997371icj.46.1344454600490; Wed, 08 Aug 2012 12:36:40 -0700 (PDT) X-Forwarded-To: linaro-patchwork@canonical.com X-Forwarded-For: patch@linaro.org linaro-patchwork@canonical.com Delivered-To: patches@linaro.org Received: by 10.50.184.200 with SMTP id ew8csp624953igc; Wed, 8 Aug 2012 12:36:39 -0700 (PDT) Received: by 10.50.237.9 with SMTP id uy9mr52402igc.40.1344454599755; Wed, 08 Aug 2012 12:36:39 -0700 (PDT) Received: from e3.ny.us.ibm.com (e3.ny.us.ibm.com. [32.97.182.143]) by mx.google.com with ESMTPS id qp2si5517548igc.21.2012.08.08.12.36.39 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 08 Aug 2012 12:36:39 -0700 (PDT) Received-SPF: neutral (google.com: 32.97.182.143 is neither permitted nor denied by best guess record for domain of john.stultz@linaro.org) client-ip=32.97.182.143; Authentication-Results: mx.google.com; spf=neutral (google.com: 32.97.182.143 is neither permitted nor denied by best guess record for domain of john.stultz@linaro.org) smtp.mail=john.stultz@linaro.org Received: from /spool/local by e3.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 8 Aug 2012 15:36:38 -0400 Received: from d01dlp01.pok.ibm.com (9.56.250.166) by e3.ny.us.ibm.com (192.168.1.103) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Wed, 8 Aug 2012 15:36:34 -0400 Received: from d01relay05.pok.ibm.com (d01relay05.pok.ibm.com [9.56.227.237]) by d01dlp01.pok.ibm.com (Postfix) with ESMTP id 268FE38C8059; Wed, 8 Aug 2012 15:36:33 -0400 (EDT) Received: from d01av04.pok.ibm.com (d01av04.pok.ibm.com [9.56.224.64]) by d01relay05.pok.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q78JaWi4162100; Wed, 8 Aug 2012 15:36:32 -0400 Received: from d01av04.pok.ibm.com (loopback [127.0.0.1]) by d01av04.pok.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q78JaWDe022397; Wed, 8 Aug 2012 15:36:32 -0400 Received: from kernel-pok.stglabs.ibm.com (kernel.stglabs.ibm.com [9.114.214.19]) by d01av04.pok.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id q78JaWnE022355; Wed, 8 Aug 2012 15:36:32 -0400 From: John Stultz To: lkml Cc: John Stultz , Ingo Molnar , Peter Zijlstra , Prarit Bhargava , Thomas Gleixner , Zhouping Liu , CAI Qian , Sasha Levin , stable@vger.kernel.org Subject: [PATCH] time: Improve sanity checking of timekeeping inputs Date: Wed, 8 Aug 2012 15:36:20 -0400 Message-Id: <1344454580-17031-1-git-send-email-john.stultz@linaro.org> X-Mailer: git-send-email 1.7.9.5 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 12080819-8974-0000-0000-00000BF7D7C1 X-Gm-Message-State: ALoCoQmXjrOHw0yGs9TI+ANc/Sz6eEbwie6nqA8f/DkdKBYXII7tWWjNyFsIr6rWPbhEPVi8QRU4 Thomas, Ingo, Here's a fix against tip/timers/urgent that addresses timekeeping edge cases detected by both a bad BIOS and system fuzzing w/ trinity. Thanks to Sasha Levin and CAI Qian for finding and reporting these! Let me know if you have any tweaks you want to see. thanks -john Unexpected behavior could occur if the time is set to a value large enough to overflow a 64bit ktime_t (which is something larger then the year 2262). Also unexpected behavior could occur if large negative offsets are injected via adjtimex. So this patch improves the sanity check timekeeping inputs by improving the timespec_valid() check, and then makes better use of timespec_valid() to make sure we don't set the time to an invalid negative value or one that overflows ktime_t. Note: This does not protect from setting the time close to overflowing ktime_t and then letting natural accumulation cause the overflow. Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Prarit Bhargava Cc: Thomas Gleixner Cc: Zhouping Liu Cc: CAI Qian Cc: Sasha Levin Cc: stable@vger.kernel.org Reported-by: CAI Qian Reported-by: Sasha Levin Signed-off-by: John Stultz --- include/linux/ktime.h | 7 ------- include/linux/time.h | 22 ++++++++++++++++++++-- kernel/time/timekeeping.c | 26 ++++++++++++++++++++++++-- 3 files changed, 44 insertions(+), 11 deletions(-) diff --git a/include/linux/ktime.h b/include/linux/ktime.h index 603bec2..06177ba10 100644 --- a/include/linux/ktime.h +++ b/include/linux/ktime.h @@ -58,13 +58,6 @@ union ktime { typedef union ktime ktime_t; /* Kill this */ -#define KTIME_MAX ((s64)~((u64)1 << 63)) -#if (BITS_PER_LONG == 64) -# define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC) -#else -# define KTIME_SEC_MAX LONG_MAX -#endif - /* * ktime_t definitions when using the 64-bit scalar representation: */ diff --git a/include/linux/time.h b/include/linux/time.h index c81c5e4..b0bbd8f 100644 --- a/include/linux/time.h +++ b/include/linux/time.h @@ -107,11 +107,29 @@ static inline struct timespec timespec_sub(struct timespec lhs, return ts_delta; } +#define KTIME_MAX ((s64)~((u64)1 << 63)) +#if (BITS_PER_LONG == 64) +# define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC) +#else +# define KTIME_SEC_MAX LONG_MAX +#endif + /* * Returns true if the timespec is norm, false if denorm: */ -#define timespec_valid(ts) \ - (((ts)->tv_sec >= 0) && (((unsigned long) (ts)->tv_nsec) < NSEC_PER_SEC)) +static inline bool timespec_valid(const struct timespec *ts) +{ + /* Dates before 1970 are bogus */ + if (ts->tv_sec < 0) + return false; + /* Can't have more nanoseconds then a second */ + if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC) + return false; + /* Disallow values that could overflow ktime_t */ + if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX) + return false; + return true; +} extern void read_persistent_clock(struct timespec *ts); extern void read_boot_clock(struct timespec *ts); diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c index e16af19..898bef0 100644 --- a/kernel/time/timekeeping.c +++ b/kernel/time/timekeeping.c @@ -427,7 +427,7 @@ int do_settimeofday(const struct timespec *tv) struct timespec ts_delta, xt; unsigned long flags; - if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC) + if (!timespec_valid(tv)) return -EINVAL; write_seqlock_irqsave(&tk->lock, flags); @@ -463,6 +463,8 @@ int timekeeping_inject_offset(struct timespec *ts) { struct timekeeper *tk = &timekeeper; unsigned long flags; + struct timespec tmp; + int ret = 0; if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC) return -EINVAL; @@ -471,10 +473,17 @@ int timekeeping_inject_offset(struct timespec *ts) timekeeping_forward_now(tk); + /* Make sure the proposed value is valid */ + tmp = timespec_add(tk_xtime(tk), *ts); + if (!timespec_valid(&tmp)) { + ret = -EINVAL; + goto error; + } tk_xtime_add(tk, ts); tk_set_wall_to_mono(tk, timespec_sub(tk->wall_to_monotonic, *ts)); +error: /* even if we error out, we forwarded the time, so call update */ timekeeping_update(tk, true); write_sequnlock_irqrestore(&tk->lock, flags); @@ -482,7 +491,7 @@ int timekeeping_inject_offset(struct timespec *ts) /* signal hrtimers about time change */ clock_was_set(); - return 0; + return ret; } EXPORT_SYMBOL(timekeeping_inject_offset); @@ -649,7 +658,20 @@ void __init timekeeping_init(void) struct timespec now, boot, tmp; read_persistent_clock(&now); + if (!timespec_valid(&now)) { + pr_warn("WARNING: Persistent clock returned invalid value!\n" + " Check your CMOS/BIOS settings.\n"); + now.tv_sec = 0; + now.tv_nsec = 0; + } + read_boot_clock(&boot); + if (!timespec_valid(&boot)) { + pr_warn("WARNING: Boot clock returned invalid value!\n" + " Check your CMOS/BIOS settings.\n"); + boot.tv_sec = 0; + boot.tv_nsec = 0; + } seqlock_init(&tk->lock);