From patchwork Fri Nov 17 02:33:24 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kefeng Wang X-Patchwork-Id: 119086 Delivered-To: patch@linaro.org Received: by 10.140.22.164 with SMTP id 33csp6334561qgn; Thu, 16 Nov 2017 18:31:19 -0800 (PST) X-Google-Smtp-Source: AGs4zMYTr0n2VNXVjIhoau/e/nA5tUAXMxOmu6ZYPlGwyX4KltAisTUc6EqASGhMXsOz0MAWepHa X-Received: by 10.98.60.209 with SMTP id b78mr419834pfk.144.1510885879109; Thu, 16 Nov 2017 18:31:19 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1510885879; cv=none; d=google.com; s=arc-20160816; b=SyUSbvYkIfOoGukpUZYBI8I+QWPsOXU7N6JASIpcp5wquXgnj+KC15d+zVRMTnxnAl HeWcQxSP0FAjXUxvaH0RyPYjF5iJPHFxUaoCIumqtA0/+X07fXFQLo/KyIyOSyWBJsXr aV1iM3oqg1mlpBQMXIjO59M/Sj3S9YDbFr3QuK1UuHXCeG7CFFsZak+NYymhbK7aMFa8 isgr3WWqYFdsDJREHaBTWVYkbUOWaLCG5vDPoz9N3HXtyynWUc0mXbjYXlVQOgNeWbRe Ie4NRoRNbWF5/L7+1hnKf8irP5yb60DRQ5+uHP7CA0iAkQKtfYpc4xo4M8iixQNbR+sW 8pTg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:arc-authentication-results; bh=2ePJo6Zk2Eb+IEKnh4O8PnCyJPJks6TjaURby9M+nwU=; b=RsNzpiAyhk6SGmsM68UQiLttlbVGl/Ydygi2ANJ81UrRvcaYaL0vrzKWzr4Jgcfh4V kOB52c3XZMdlWID8ilH0IILoo85Urtik1OmgoDndqRmRICl7aMvr1vnooaZjWk4evLXD 2APDrwmY7QoKLGUJGSLDx6Q4kKWqs9XT13uVVXXBHH5uHD8H5fWLF2YYrh0RY19s5801 HXFbQBhHV/4GCTdTksAqxjCyuFkIjUjz9x4NCQEfF7da3N5jf2Ow7dni9yCrMkJKzrdx 2k0w5HfC+4GDQ08ys9DjRS0wWYH1A2qSy8vrDY2zIPO81wDLdts6mCjbpdY+YR+01vWk kZtA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id o2si1903651pll.585.2017.11.16.18.31.18; Thu, 16 Nov 2017 18:31:19 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755649AbdKQCbR (ORCPT + 9 others); Thu, 16 Nov 2017 21:31:17 -0500 Received: from szxga05-in.huawei.com ([45.249.212.191]:10998 "EHLO szxga05-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755611AbdKQCbM (ORCPT ); Thu, 16 Nov 2017 21:31:12 -0500 Received: from 172.30.72.59 (EHLO DGGEMS407-HUB.china.huawei.com) ([172.30.72.59]) by dggrg05-dlp.huawei.com (MOS 4.4.6-GA FastPath queued) with ESMTP id DLC63114; Fri, 17 Nov 2017 10:31:09 +0800 (CST) Received: from localhost.localdomain.localdomain (10.175.113.25) by DGGEMS407-HUB.china.huawei.com (10.3.19.207) with Microsoft SMTP Server id 14.3.361.1; Fri, 17 Nov 2017 10:30:57 +0800 From: Kefeng Wang To: , , , CC: zengtao , , , Thomas Gleixner , Kefeng Wang Subject: [PATCH 7.x ubsan fix 1/6] cputime: Prevent 32bit overflow in time[val|spec]_to_cputime() Date: Fri, 17 Nov 2017 10:33:24 +0800 Message-ID: <1510886009-141575-2-git-send-email-wangkefeng.wang@huawei.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1510886009-141575-1-git-send-email-wangkefeng.wang@huawei.com> References: <1510886009-141575-1-git-send-email-wangkefeng.wang@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.175.113.25] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020201.5A0E49ED.00A1, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 082ddb309233578b033b8412134c1613 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: zengtao mainline inclusion from mainline-4.5 commit 0f26922fe5dc5724b1adbbd54b21bad03590b4f3 category: bugfix bugzilla: 3214 DTS: NA CVE: NA ------------------------------------------------- The datatype __kernel_time_t is u32 on 32bit platform, so its subject to overflows in the timeval/timespec to cputime conversion. Currently the following functions are affected: 1. setitimer() 2. timer_create/timer_settime() 3. sys_clock_nanosleep This can happen on MIPS32 and ARM32 with "Full dynticks CPU time accounting" enabled, which is required for CONFIG_NO_HZ_FULL. Enforce u64 conversion to prevent the overflow. Fixes: 31c1fc818715 ("ARM: Kconfig: allow full nohz CPU accounting") Signed-off-by: zengtao Reviewed-by: Arnd Bergmann Cc: Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1454384314-154784-1-git-send-email-prime.zeng@huawei.com Signed-off-by: Thomas Gleixner (cherry picked from commit 0f26922fe5dc5724b1adbbd54b21bad03590b4f3) Signed-off-by: Kefeng Wang --- include/asm-generic/cputime_nsecs.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 1.8.3.1 diff --git a/include/asm-generic/cputime_nsecs.h b/include/asm-generic/cputime_nsecs.h index bf97df3..903285b 100644 --- a/include/asm-generic/cputime_nsecs.h +++ b/include/asm-generic/cputime_nsecs.h @@ -72,7 +72,7 @@ typedef u64 __nocast cputime64_t; */ static inline cputime_t timespec_to_cputime(const struct timespec *val) { - u64 ret = val->tv_sec * NSEC_PER_SEC + val->tv_nsec; + u64 ret = (u64)val->tv_sec * NSEC_PER_SEC + val->tv_nsec; return (__force cputime_t) ret; } static inline void cputime_to_timespec(const cputime_t ct, struct timespec *val) @@ -88,7 +88,8 @@ static inline void cputime_to_timespec(const cputime_t ct, struct timespec *val) */ static inline cputime_t timeval_to_cputime(const struct timeval *val) { - u64 ret = val->tv_sec * NSEC_PER_SEC + val->tv_usec * NSEC_PER_USEC; + u64 ret = (u64)val->tv_sec * NSEC_PER_SEC + + val->tv_usec * NSEC_PER_USEC; return (__force cputime_t) ret; } static inline void cputime_to_timeval(const cputime_t ct, struct timeval *val)