linux/include
Zeng Tao 68e51bf376 time: Prevent undefined behaviour in timespec64_to_ns()
[ Upstream commit cb47755725 ]

UBSAN reports:

Undefined behaviour in ./include/linux/time64.h:127:27
signed integer overflow:
17179869187 * 1000000000 cannot be represented in type 'long long int'
Call Trace:
 timespec64_to_ns include/linux/time64.h:127 [inline]
 set_cpu_itimer+0x65c/0x880 kernel/time/itimer.c:180
 do_setitimer+0x8e/0x740 kernel/time/itimer.c:245
 __x64_sys_setitimer+0x14c/0x2c0 kernel/time/itimer.c:336
 do_syscall_64+0xa1/0x540 arch/x86/entry/common.c:295

Commit bd40a17576 ("y2038: itimer: change implementation to timespec64")
replaced the original conversion which handled time clamping correctly with
timespec64_to_ns() which has no overflow protection.

Fix it in timespec64_to_ns() as this is not necessarily limited to the
usage in itimers.

[ tglx: Added comment and adjusted the fixes tag ]

Fixes: 361a3bf005 ("time64: Add time64.h header and define struct timespec64")
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1598952616-6416-1-git-send-email-prime.zeng@hisilicon.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-18 19:18:40 +01:00
..
acpi x86: ACPI: fix CPU hotplug deadlock 2020-04-23 10:30:20 +02:00
asm-generic mm: always have io_remap_pfn_range() set pgprot_decrypted() 2020-11-10 12:35:58 +01:00
clocksource
crypto crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-07-09 09:37:10 +02:00
drm drm/panel: make drm_panel.h self-contained 2020-01-27 14:51:01 +01:00
dt-bindings dt-bindings: reset: meson8b: fix duplicate reset IDs 2020-01-23 08:21:26 +01:00
keys KEYS: Don't write out to userspace while holding key semaphore 2020-04-23 10:30:24 +02:00
kvm KVM: arm/arm64: Sync ICH_VMCR_EL2 back when about to block 2019-08-25 10:47:59 +02:00
linux time: Prevent undefined behaviour in timespec64_to_ns() 2020-11-18 19:18:40 +01:00
math-emu math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning 2019-12-13 08:51:34 +01:00
media media: v4l2-device.h: Explicitly compare grp{id,mask} to zero in v4l2_device macros 2020-02-24 08:34:41 +01:00
memory
misc
net net: dsa: read mac address from DT for slave device 2020-11-10 12:36:02 +01:00
pcmcia pcmcia: remove long deprecated pcmcia_request_exclusive_irq() function 2018-08-18 12:30:42 -07:00
ras
rdma RDMA/core: Fix double destruction of uobject 2020-06-03 08:19:43 +02:00
scsi scsi: target: core: Add CONTROL field for trace events 2020-10-30 10:38:29 +01:00
soc irqchip/eznps: Fix build error for !ARC700 builds 2020-09-17 13:45:25 +02:00
sound ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on the Lenovo Miix 2 10 2020-07-29 10:16:58 +02:00
target scsi: target: fix hang when multiple threads try to destroy the same iscsi session 2020-04-21 09:03:11 +02:00
trace scsi: target: core: Add CONTROL field for trace events 2020-10-30 10:38:29 +01:00
uapi NFSv4.2: support EXCHGID4_FLAG_SUPP_FENCE_OPS 4.2 EXCHANGE_ID flag 2020-11-05 11:08:51 +01:00
video udlfb: introduce a rendering mutex 2019-05-25 18:23:30 +02:00
xen xen/events: add a new "late EOI" evtchn framework 2020-11-05 11:08:36 +01:00