From d69cfd33b5a8d176124c564513b9ceb933595d93 Mon Sep 17 00:00:00 2001 From: Hungyu Lin Date: Tue, 20 Oct 2026 23:34:33 +0000 Subject: [PATCH] time/namespace: Fix overflow when converting absolute deadlines do_timens_ktime_to_host() subtracts the namespace offset from an absolute deadline and clamps the result to [0, KTIME_MAX]. A negative offset can make a large deadline overflow to a negative value. Since ktime_t is signed and KTIME_MAX is its maximum value, the subsequent comparison against KTIME_MAX can never detect this overflow. For example, with a -1 second boottime offset, an absolute CLOCK_BOOTTIME timerfd deadline of KTIME_MAX can expire immediately. An absolute clock_nanosleep() using the same clock and deadline can also return immediately instead of waiting. The earlier tim < offset check already handles the lower bound. A negative subtraction result in the remaining branch therefore indicates overflow. Detect that result and clamp it to KTIME_MAX. Fixes: 89dd8eecfe961 ("time: Add do_timens_ktime_to_host() helper") Signed-off-by: Hungyu Lin Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261020233433.20997-1-dennylin0707@gmail.com --- kernel/time/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/time/namespace.c b/kernel/time/namespace.c index 3aff27bb0a15..635f7e544bcc 100644 --- a/kernel/time/namespace.c +++ b/kernel/time/namespace.c @@ -51,7 +51,7 @@ ktime_t do_timens_ktime_to_host(clockid_t clockid, ktime_t tim, tim = 0; } else { tim = ktime_sub(tim, offset); - if (unlikely(tim > KTIME_MAX)) + if (unlikely(tim < 0)) tim = KTIME_MAX; }