Module Name: src
Committed By: riastradh
Date: Sat Mar 12 16:46:57 UTC 2022
Modified Files:
src/sys/kern: kern_time.c
Log Message:
kern: Clamp time_adjtime to avoid overflow.
Reported-by: syzbot+7edce1a31dfd2a5ea...@syzkaller.appspotmail.com
To generate a diff of this commit:
cvs rdiff -u -r1.211 -r1.212 src/sys/kern/kern_time.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/kern_time.c
diff -u src/sys/kern/kern_time.c:1.211 src/sys/kern/kern_time.c:1.212
--- src/sys/kern/kern_time.c:1.211 Sat Apr 3 12:57:21 2021
+++ src/sys/kern/kern_time.c Sat Mar 12 16:46:57 2022
@@ -1,4 +1,4 @@
-/* $NetBSD: kern_time.c,v 1.211 2021/04/03 12:57:21 simonb Exp $ */
+/* $NetBSD: kern_time.c,v 1.212 2022/03/12 16:46:57 riastradh Exp $ */
/*-
* Copyright (c) 2000, 2004, 2005, 2007, 2008, 2009, 2020
@@ -62,7 +62,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_time.c,v 1.211 2021/04/03 12:57:21 simonb Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_time.c,v 1.212 2022/03/12 16:46:57 riastradh Exp $");
#include <sys/param.h>
#include <sys/resourcevar.h>
@@ -610,10 +610,19 @@ adjtime1(const struct timeval *delta, st
}
mutex_spin_exit(&timecounter_lock);
}
-
+
if (delta) {
mutex_spin_enter(&timecounter_lock);
- time_adjtime = delta->tv_sec * 1000000 + delta->tv_usec;
+ /*
+ * XXX This should maybe just report failure to
+ * userland for nonsense deltas.
+ */
+ if (delta->tv_sec > INT64_MAX/1000000 - 1) {
+ time_adjtime = INT64_MAX;
+ } else {
+ time_adjtime = MAX(0, delta->tv_sec) * 1000000
+ + MAX(0, MIN(999999, delta->tv_usec));
+ }
if (time_adjtime) {
/* We need to save the system time during shutdown */
