Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/kernel
History
Justin Stitt 54fe4e90b4 ntp: Clamp maxerror and esterror to operating range 
[ Upstream commit 87d571d6fb77ec342a985afa8744bb9bb75b3622 ]

Using syzkaller alongside the newly reintroduced signed integer overflow
sanitizer spits out this report:

UBSAN: signed-integer-overflow in ../kernel/time/ntp.c:461:16
9223372036854775807 + 500 cannot be represented in type 'long'
Call Trace:
 handle_overflow+0x171/0x1b0
 second_overflow+0x2d6/0x500
 accumulate_nsecs_to_secs+0x60/0x160
 timekeeping_advance+0x1fe/0x890
 update_wall_time+0x10/0x30

time_maxerror is unconditionally incremented and the result is checked
against NTP_PHASE_LIMIT, but the increment itself can overflow, resulting
in wrap-around to negative space.

Before commit eea83d896e31 ("ntp: NTP4 user space bits update") the user
supplied value was sanity checked to be in the operating range. That change
removed the sanity check and relied on clamping in handle_overflow() which
does not work correctly when the user supplied value is in the overflow
zone of the '+ 500' operation.

The operation requires CAP_SYS_TIME and the side effect of the overflow is
NTP getting out of sync.

Miroslav confirmed that the input value should be clamped to the operating
range and the same applies to time_esterror. The latter is not used by the
kernel, but the value still should be in the operating range as it was
before the sanity check got removed.

Clamp them to the operating range.

[ tglx: Changed it to clamping and included time_esterror ]

Fixes: eea83d896e31 ("ntp: NTP4 user space bits update")
Signed-off-by: Justin Stitt <justinstitt@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Miroslav Lichvar <mlichvar@redhat.com>
Link: https://lore.kernel.org/all/20240517-b4-sio-ntp-usec-v2-1-d539180f2b79@google.com
Closes: https://github.com/KSPP/linux/issues/354
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ cast things to long long to fix compiler warnings - gregkh ]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-23 23:20:28 +01:00
..
bpf bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o 2024-11-23 23:20:08 +01:00
cgroup cgroup: rstat: punt root-level optimization to individual controllers 2024-11-19 17:40:21 +01:00
configs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
debug kdb: Use the passed prompt in kdb_position_cursor() 2024-11-23 23:20:16 +01:00
dma dma: fix call order in dmam_free_coherent 2024-11-23 23:20:17 +01:00
entry Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
events perf: Prevent passing zero nr_pages to rb_alloc_aux() 2024-11-23 23:20:08 +01:00
futex futex: Don't include process MM in futex key on no-MMU 2024-11-18 11:42:47 +01:00
gcov gcov: add support for GCC 14 2024-11-19 14:19:10 +01:00
irq genirq: Allow irq_chip registration functions to take a const irq_chip 2024-11-23 23:20:21 +01:00
kcsan Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
livepatch kallsyms: refactor {,module_}kallsyms_on_each_symbol 2024-11-19 12:27:32 +01:00
locking locking/rwlocks: introduce write_lock_nested 2024-11-19 17:44:05 +01:00
power power/wakelock: Add a timeout to wakelocks globally 2024-11-19 18:06:07 +01:00
printk printk: Silence useless system log spam 2024-11-19 18:04:40 +01:00
rcu rcutorture: Fix rcu_torture_fwd_cb_cr() data race 2024-11-23 23:20:22 +01:00
sched sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime 2024-11-23 23:20:24 +01:00
time ntp: Clamp maxerror and esterror to operating range 2024-11-23 23:20:28 +01:00
trace tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test 2024-11-19 14:19:29 +01:00
acct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
async.c async: Introduce async_schedule_dev_nocall() 2024-11-18 12:12:56 +01:00
audit.c audit: Send netlink ACK before setting connection in auditd_set 2024-11-18 12:13:09 +01:00
audit.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
audit_fsnotify.c fsnotify: make allow_dups a property of the group 2024-11-19 12:27:55 +01:00
audit_tree.c fsnotify: pass flags argument to fsnotify_alloc_group() 2024-11-19 12:27:55 +01:00
audit_watch.c fsnotify: pass flags argument to fsnotify_alloc_group() 2024-11-19 12:27:55 +01:00
auditfilter.c ima: Avoid blocking in RCU read-side critical section 2024-11-19 14:19:42 +01:00
auditsc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
backtracetest.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bounds.c bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS 2024-11-19 11:32:40 +01:00
capability.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cfi.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
compat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
configs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
context_tracking.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cpu.c cpu: Silence log spam when a CPU is brought up 2024-11-19 18:04:55 +01:00
cpu_pm.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
crash_core.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
crash_dump.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cred.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
delayacct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dma.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
exec_domain.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
exit.c mm: optimize the redundant loop of mm_update_owner_next() 2024-11-19 14:19:41 +01:00
extable.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fail_function.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fork.c exec: Simplify unshare_files 2024-11-19 12:27:27 +01:00
freezer.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gen_kheaders.sh kheaders: explicitly define file modes for archived headers 2024-11-19 14:19:30 +01:00
groups.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hung_task.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iomem.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
irq_work.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
jump_label.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kallsyms.c kallsyms: Improve the performance of kallsyms_lookup_name() 2024-11-19 18:06:35 +01:00
kcmp.c kcmp: In get_file_raw_ptr use task_lookup_fd_rcu 2024-11-19 12:27:27 +01:00
Kconfig.freezer Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig.hz Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig.locks Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig.preempt Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kcov.c kcov: don't lose track of remote references during softirqs 2024-11-19 14:19:10 +01:00
kexec.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec_core.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec_elf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec_file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec_internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kheaders.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kmod.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kprobes.c kprobes: Fix to check symbol prefixes correctly 2024-11-23 23:20:27 +01:00
ksysfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kthread.c exit: Implement kthread_exit 2024-11-19 12:27:49 +01:00
latencytop.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile kernel: Use the stock defconfig for /proc/config.gz 2024-06-15 16:20:14 -03:00
module-internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
module.c NFSD: Remove svc_serv_ops::svo_module 2024-11-19 12:27:54 +01:00
module_signature.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
module_signing.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
notifier.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nsproxy.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
padata.c padata: Disable BH when taking works lock on MT path 2024-11-19 14:19:06 +01:00
panic.c panic: Flush kernel log buffer at the end 2024-11-19 09:23:11 +01:00
params.c params: lift param_set_uint_minmax to common code 2024-11-19 12:27:09 +01:00
pid.c kernel/pid.c: implement additional checks upon pidfd_create() parameters 2024-11-19 12:27:43 +01:00
pid_namespace.c zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING 2024-11-19 14:19:05 +01:00
profile.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ptrace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
range.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reboot.c kernel/reboot: emergency_restart: Set correct system_state 2024-11-18 11:43:25 +01:00
regset.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
relay.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
resource.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rseq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
scftorture.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
scs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
seccomp.c seccomp: Invalidate seccomp mode to catch death failures 2024-11-18 22:25:35 +01:00
signal.c kernel: rerun task_work while freezing in get_signal() 2024-11-23 23:20:16 +01:00
smp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
smpboot.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
smpboot.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
softirq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stackleak.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stacktrace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
static_call.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stop_machine.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sys.c kernel/sys.c: implement custom uname override 2024-11-19 17:55:01 +01:00
sys_ni.c syscalls: fix compat_sys_io_pgetevents_time64 usage 2024-11-19 14:19:34 +01:00
sysctl-test.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysctl.c Revert "kernel: sysctl: add init protection to common mm-related nodes" 2024-11-19 18:13:49 +01:00
task_work.c task_work: Introduce task_work_cancel() again 2024-11-23 23:20:13 +01:00
taskstats.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_kprobes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
torture.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tracepoint.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tsacct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ucount.c fanotify: configurable limits via sysfs 2024-11-19 12:27:37 +01:00
uid16.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uid16.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
umh.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
up.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user-return-notifier.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user_namespace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
usermode_driver.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
utsname.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
utsname_sysctl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
watch_queue.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
watchdog.c watchdog: move softlockup_panic back to early_param 2024-11-18 11:43:21 +01:00
watchdog_hld.c watchdog/perf: properly initialize the turbo mode timestamp and rearm counter 2024-11-23 23:20:15 +01:00
workqueue.c Revert "workqueue: Make queue_rcu_work() use call_rcu_flush()" 2024-11-19 18:15:40 +01:00
workqueue_internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00