From patchwork Tue Sep 18 00:36:18 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Stultz X-Patchwork-Id: 11481 Return-Path: X-Original-To: patchwork@peony.canonical.com Delivered-To: patchwork@peony.canonical.com Received: from fiordland.canonical.com (fiordland.canonical.com [91.189.94.145]) by peony.canonical.com (Postfix) with ESMTP id 75D4923E53 for ; Tue, 18 Sep 2012 01:10:56 +0000 (UTC) Received: from mail-ie0-f180.google.com (mail-ie0-f180.google.com [209.85.223.180]) by fiordland.canonical.com (Postfix) with ESMTP id 6761DA18E4A for ; Tue, 18 Sep 2012 01:10:55 +0000 (UTC) Received: by ieak11 with SMTP id k11so10097209iea.11 for ; Mon, 17 Sep 2012 18:10:54 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-forwarded-to:x-forwarded-for:delivered-to:received-spf:from:to:cc :subject:date:message-id:x-mailer:in-reply-to:references :x-content-scanned:x-cbid:x-ibm-iss-spamdetectors :x-ibm-iss-detailinfo:x-gm-message-state; bh=m9q0EhIratWIyqmqznv4wUhPchOCnF6VVYirZEgJNe4=; b=LmJNpbN7J/4DQUPNxioy5DM/9wSM+qRox9CB3GrhNyCHVBcr81lYik0t5lAXx4QbD0 FspdlWUPyJAUX6aYTuI3YnzsH29ZnQbEyIKsDeNbGwZt5gXrZUxv/O/WJ7uArQ526zMP O9GDFkU7Pe6PFHnMGSIK3861CH8b+S19fJjbRhwRF0QAca+nCqEEjPS8nYC6IyaFNCJB 87cMHxZSWTaQs9JknEVxaaQIu/CLl56t7sI/99Nqu5UclfbekvRmddybQYcV0fXfqODv ezDwvcD7ZDLw3u6WUW6BWezgfW2t8SsavMwiwSg9sbaSImKixZqC0Vdnnr0baafGVmlQ KMlQ== Received: by 10.42.109.194 with SMTP id m2mr10325471icp.48.1347930654386; Mon, 17 Sep 2012 18:10:54 -0700 (PDT) X-Forwarded-To: linaro-patchwork@canonical.com X-Forwarded-For: patch@linaro.org linaro-patchwork@canonical.com Delivered-To: patches@linaro.org Received: by 10.50.184.232 with SMTP id ex8csp347132igc; Mon, 17 Sep 2012 18:10:53 -0700 (PDT) Received: by 10.182.218.37 with SMTP id pd5mr13688588obc.24.1347930652869; Mon, 17 Sep 2012 18:10:52 -0700 (PDT) Received: from e33.co.us.ibm.com (e33.co.us.ibm.com. [32.97.110.151]) by mx.google.com with ESMTPS id e3si11866360obd.111.2012.09.17.18.10.52 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 17 Sep 2012 18:10:52 -0700 (PDT) Received-SPF: neutral (google.com: 32.97.110.151 is neither permitted nor denied by best guess record for domain of john.stultz@linaro.org) client-ip=32.97.110.151; Authentication-Results: mx.google.com; spf=neutral (google.com: 32.97.110.151 is neither permitted nor denied by best guess record for domain of john.stultz@linaro.org) smtp.mail=john.stultz@linaro.org Received: from /spool/local by e33.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 17 Sep 2012 19:10:51 -0600 Received: from d03dlp02.boulder.ibm.com (9.17.202.178) by e33.co.us.ibm.com (192.168.1.133) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 17 Sep 2012 18:36:53 -0600 Received: from d03relay04.boulder.ibm.com (d03relay04.boulder.ibm.com [9.17.195.106]) by d03dlp02.boulder.ibm.com (Postfix) with ESMTP id A10C23E40042; Mon, 17 Sep 2012 18:36:23 -0600 (MDT) Received: from d03av06.boulder.ibm.com (d03av06.boulder.ibm.com [9.17.195.245]) by d03relay04.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q8I0aPUJ223060; Mon, 17 Sep 2012 18:36:25 -0600 Received: from d03av06.boulder.ibm.com (loopback [127.0.0.1]) by d03av06.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q8I0buO9008546; Mon, 17 Sep 2012 18:37:56 -0600 Received: from kernel-pok.stglabs.ibm.com (kernel.stglabs.ibm.com [9.114.214.19]) by d03av06.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id q8I0bspD008500; Mon, 17 Sep 2012 18:37:55 -0600 From: John Stultz To: stable@vger.kernel.org Cc: John Stultz , Peter Zijlstra , Prarit Bhargava , Zhouping Liu , Ingo Molnar , Thomas Gleixner Subject: [PATCH 1/3] 2.6.35.y: time: Improve sanity checking of timekeeping inputs Date: Mon, 17 Sep 2012 20:36:18 -0400 Message-Id: <1347928580-22833-2-git-send-email-john.stultz@linaro.org> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1347928580-22833-1-git-send-email-john.stultz@linaro.org> References: <1347928580-22833-1-git-send-email-john.stultz@linaro.org> X-Content-Scanned: Fidelis XPS MAILER x-cbid: 12091800-2398-0000-0000-00000B1007DC X-IBM-ISS-SpamDetectors: X-IBM-ISS-DetailInfo: BY=3.00000294; HX=3.00000196; KW=3.00000007; PH=3.00000001; SC=3.00000007; SDB=6.00175066; UDB=6.00039647; UTC=2012-09-18 01:10:50 X-Gm-Message-State: ALoCoQmWwcS+Th7CPYEuiKSTl1sLwWu36Fup66pZ9SSIICaY4Dbbhbvrqc7WVW3IzVRS7mP22wJq This is a -stable backport of 4e8b14526ca7fb046a81c94002c1c43b6fdf0e9b Unexpected behavior could occur if the time is set to a value large enough to overflow a 64bit ktime_t (which is something larger then the year 2262). Also unexpected behavior could occur if large negative offsets are injected via adjtimex. So this patch improves the sanity check timekeeping inputs by improving the timespec_valid() check, and then makes better use of timespec_valid() to make sure we don't set the time to an invalid negative value or one that overflows ktime_t. Note: This does not protect from setting the time close to overflowing ktime_t and then letting natural accumulation cause the overflow. Reported-by: CAI Qian Reported-by: Sasha Levin Signed-off-by: John Stultz Cc: Peter Zijlstra Cc: Prarit Bhargava Cc: Zhouping Liu Cc: Ingo Molnar Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1344454580-17031-1-git-send-email-john.stultz@linaro.org Signed-off-by: Thomas Gleixner Signed-off-by: John Stultz --- include/linux/ktime.h | 7 ------- include/linux/time.h | 22 ++++++++++++++++++++-- kernel/time/timekeeping.c | 15 ++++++++++++++- 3 files changed, 34 insertions(+), 10 deletions(-) diff --git a/include/linux/ktime.h b/include/linux/ktime.h index e1ceaa9..07f9d7b 100644 --- a/include/linux/ktime.h +++ b/include/linux/ktime.h @@ -58,13 +58,6 @@ union ktime { typedef union ktime ktime_t; /* Kill this */ -#define KTIME_MAX ((s64)~((u64)1 << 63)) -#if (BITS_PER_LONG == 64) -# define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC) -#else -# define KTIME_SEC_MAX LONG_MAX -#endif - /* * ktime_t definitions when using the 64-bit scalar representation: */ diff --git a/include/linux/time.h b/include/linux/time.h index ea3559f0..f040fb0 100644 --- a/include/linux/time.h +++ b/include/linux/time.h @@ -91,11 +91,29 @@ static inline struct timespec timespec_sub(struct timespec lhs, return ts_delta; } +#define KTIME_MAX ((s64)~((u64)1 << 63)) +#if (BITS_PER_LONG == 64) +# define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC) +#else +# define KTIME_SEC_MAX LONG_MAX +#endif + /* * Returns true if the timespec is norm, false if denorm: */ -#define timespec_valid(ts) \ - (((ts)->tv_sec >= 0) && (((unsigned long) (ts)->tv_nsec) < NSEC_PER_SEC)) +static inline bool timespec_valid(const struct timespec *ts) +{ + /* Dates before 1970 are bogus */ + if (ts->tv_sec < 0) + return false; + /* Can't have more nanoseconds then a second */ + if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC) + return false; + /* Disallow values that could overflow ktime_t */ + if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX) + return false; + return true; +} extern struct timespec xtime; extern struct timespec wall_to_monotonic; diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c index 782f13d..4f760d4 100644 --- a/kernel/time/timekeeping.c +++ b/kernel/time/timekeeping.c @@ -337,7 +337,7 @@ int do_settimeofday(struct timespec *tv) struct timespec ts_delta; unsigned long flags; - if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC) + if (!timespec_valid(tv)) return -EINVAL; write_seqlock_irqsave(&xtime_lock, flags); @@ -551,7 +551,20 @@ void __init timekeeping_init(void) struct timespec now, boot; read_persistent_clock(&now); + if (!timespec_valid(&now)) { + pr_warn("WARNING: Persistent clock returned invalid value!\n" + " Check your CMOS/BIOS settings.\n"); + now.tv_sec = 0; + now.tv_nsec = 0; + } + read_boot_clock(&boot); + if (!timespec_valid(&boot)) { + pr_warn("WARNING: Boot clock returned invalid value!\n" + " Check your CMOS/BIOS settings.\n"); + boot.tv_sec = 0; + boot.tv_nsec = 0; + } write_seqlock_irqsave(&xtime_lock, flags);