From patchwork Mon Nov 18 21:49:03 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 179616 Delivered-To: patch@linaro.org Received: by 2002:a92:38d5:0:0:0:0:0 with SMTP id g82csp3455756ilf; Mon, 18 Nov 2019 13:50:05 -0800 (PST) X-Google-Smtp-Source: APXvYqy0yJ7RgjeG+POZDJiMORMRRvf0s63yh86NOrf3tcNK6Zo5qdkfexdlovaDBAjrxxF+EUgV X-Received: by 2002:adf:e883:: with SMTP id d3mr31987208wrm.197.1574113805825; Mon, 18 Nov 2019 13:50:05 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1574113805; cv=none; d=google.com; s=arc-20160816; b=F6wcI3GN8oV6huIMzM3sdVmpbbblP+oV+RJP9sdM0/OoKARUhMmyPGkG7jZniInZGn VRwRz87gFeN5XF+7iwzo/0mgrxqhLc44wpDaVweF5rcA9Cix75jWuluBt7LgFCLOIZ04 Y8AFbzf5AOJ2nKJbTTvkmwaxIIawnJ6gFqPnW0JpYObZjB+rat62G353EQuRpEMzxe5v vgILWY1A+FJXQBbz1rMxvC3FuvNSDJQcwo4NzGPbP1txkkXQ27dhePr2oKbigquSvfcg fp4y9iKI4R17s6ugI1vum5eBsEeKmzdKXE6oauDP2m4u6ohfw+wzFGuQX7Vzy5BuYAhM Tspw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from; bh=w4bWjhaF9dr2rGRRHRodrP0ZZRpGzneXIgf6ja0UhPk=; b=PnxBUPk+dGHe6nyLj7SVbJjRa32/p9q6abruWJKKcgHnRHf0F9mg1FDZ1Hf8ct07k2 xTWVmVsZ2gG37wwaHY6+noRMMQdyVK3az/JMew1nBhVEqOUGkI3ThROJ+hMklGMdNq2R yBbhPxjx7SiiKQ2W//NabWI6kaNNO0g133Dogegzlj+tYfYfzKQHzUMhe8lQUT6AIO2b onpfGJO8J8Y5+EevosKYdjHKS2+CrRj5qTp3v7YoyyuQozMoWOFEmKa23C8jqu+bCv3g v40VB7q2nYVqpgtYQlgTf/44sFNY7rRkaafCzTEtBECozPNs3E1t7Tk7J5f09sW8kiRQ t0xA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=netdev-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id p20si14157879edi.252.2019.11.18.13.50.05; Mon, 18 Nov 2019 13:50:05 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=netdev-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727164AbfKRVuA (ORCPT + 9 others); Mon, 18 Nov 2019 16:50:00 -0500 Received: from correo.us.es ([193.147.175.20]:45716 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726705AbfKRVtf (ORCPT ); Mon, 18 Nov 2019 16:49:35 -0500 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id 3AAB0EB491 for ; Mon, 18 Nov 2019 22:49:31 +0100 (CET) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 1DCF0A7EC8 for ; Mon, 18 Nov 2019 22:49:31 +0100 (CET) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id 12DD4A7EC5; Mon, 18 Nov 2019 22:49:31 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id A458D202AE; Mon, 18 Nov 2019 22:49:25 +0100 (CET) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Mon, 18 Nov 2019 22:49:25 +0100 (CET) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from salvia.here (sys.soleta.eu [212.170.55.40]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id 7600C42EE38F; Mon, 18 Nov 2019 22:49:25 +0100 (CET) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org Subject: [PATCH 07/18] netfilter: xt_time: use time64_t Date: Mon, 18 Nov 2019 22:49:03 +0100 Message-Id: <20191118214914.142794-8-pablo@netfilter.org> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20191118214914.142794-1-pablo@netfilter.org> References: <20191118214914.142794-1-pablo@netfilter.org> X-Virus-Scanned: ClamAV using ClamSMTP Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Arnd Bergmann The current xt_time driver suffers from the y2038 overflow on 32-bit architectures, when the time of day calculations break. Also, on both 32-bit and 64-bit architectures, there is a problem with info->date_start/stop, which is part of the user ABI and overflows in in 2106. Fix the first issue by using time64_t and explicit calls to div_u64() and div_u64_rem(), and document the seconds issue. The explicit 64-bit division is unfortunately slower on 32-bit architectures, but doing it as unsigned lets us use the optimized division-through-multiplication path in most configurations. This should be fine, as the code already does not allow any negative time of day values. Using u32 seconds values consistently would probably also work and be a little more efficient, but that doesn't feel right as it would propagate the y2106 overflow to more place rather than fewer. Signed-off-by: Arnd Bergmann Signed-off-by: Pablo Neira Ayuso --- net/netfilter/xt_time.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) -- 2.11.0 diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c index 8dbb4d48f2ed..67cb98489415 100644 --- a/net/netfilter/xt_time.c +++ b/net/netfilter/xt_time.c @@ -77,12 +77,12 @@ static inline bool is_leap(unsigned int y) * This is done in three separate functions so that the most expensive * calculations are done last, in case a "simple match" can be found earlier. */ -static inline unsigned int localtime_1(struct xtm *r, time_t time) +static inline unsigned int localtime_1(struct xtm *r, time64_t time) { unsigned int v, w; /* Each day has 86400s, so finding the hour/minute is actually easy. */ - v = time % SECONDS_PER_DAY; + div_u64_rem(time, SECONDS_PER_DAY, &v); r->second = v % 60; w = v / 60; r->minute = w % 60; @@ -90,13 +90,13 @@ static inline unsigned int localtime_1(struct xtm *r, time_t time) return v; } -static inline void localtime_2(struct xtm *r, time_t time) +static inline void localtime_2(struct xtm *r, time64_t time) { /* * Here comes the rest (weekday, monthday). First, divide the SSTE * by seconds-per-day to get the number of _days_ since the epoch. */ - r->dse = time / 86400; + r->dse = div_u64(time, SECONDS_PER_DAY); /* * 1970-01-01 (w=0) was a Thursday (4). @@ -105,7 +105,7 @@ static inline void localtime_2(struct xtm *r, time_t time) r->weekday = (4 + r->dse - 1) % 7 + 1; } -static void localtime_3(struct xtm *r, time_t time) +static void localtime_3(struct xtm *r, time64_t time) { unsigned int year, i, w = r->dse; @@ -160,7 +160,7 @@ time_mt(const struct sk_buff *skb, struct xt_action_param *par) const struct xt_time_info *info = par->matchinfo; unsigned int packet_time; struct xtm current_time; - s64 stamp; + time64_t stamp; /* * We need real time here, but we can neither use skb->tstamp @@ -173,14 +173,14 @@ time_mt(const struct sk_buff *skb, struct xt_action_param *par) * 1. match before 13:00 * 2. match after 13:00 * - * If you match against processing time (get_seconds) it + * If you match against processing time (ktime_get_real_seconds) it * may happen that the same packet matches both rules if * it arrived at the right moment before 13:00, so it would be * better to check skb->tstamp and set it via __net_timestamp() * if needed. This however breaks outgoing packets tx timestamp, * and causes them to get delayed forever by fq packet scheduler. */ - stamp = get_seconds(); + stamp = ktime_get_real_seconds(); if (info->flags & XT_TIME_LOCAL_TZ) /* Adjust for local timezone */ @@ -193,6 +193,9 @@ time_mt(const struct sk_buff *skb, struct xt_action_param *par) * - 'now' is in the weekday mask * - 'now' is in the daytime range time_start..time_end * (and by default, libxt_time will set these so as to match) + * + * note: info->date_start/stop are unsigned 32-bit values that + * can hold values beyond y2038, but not after y2106. */ if (stamp < info->date_start || stamp > info->date_stop) From patchwork Mon Nov 18 21:49:04 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 179615 Delivered-To: patch@linaro.org Received: by 2002:a92:38d5:0:0:0:0:0 with SMTP id g82csp3455707ilf; Mon, 18 Nov 2019 13:50:02 -0800 (PST) X-Google-Smtp-Source: APXvYqy6nAbTPG6aY9cf+TT7moXxTahj0kJRtf+RMNSpF5xf9vKdrawP8cI731BVwyUGHliuFKeT X-Received: by 2002:adf:f18c:: with SMTP id h12mr14024004wro.122.1574113802454; Mon, 18 Nov 2019 13:50:02 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1574113802; cv=none; d=google.com; s=arc-20160816; b=KzfFY0VaSQbbmzfOzJd2JlQw6TS1i2i56D7G8MeLMjNhKkeZrGfa60SuDmkhMyENy0 8s2YllJFnSJbre7g5rWmKprO7j4ltXZXcGVoUK1kz7Pn7vDdIHqRrAvGRwuU0pSNNGqu b5XqaPbC2UFXqGxVJk0py/doEw8n3nUYSAapPsP60xOB6/pkUrjMS+/II27fyKxh9xcb yYRn4UqRK89xZ8zrK9Xdg8wO7rppZysC290bg+lIEeIA9VSnfDYB5cH6u5wVoteUg4k6 nOga4uvZwmNPFVIizkPI3cjGaqDjTNekTUAc/lNvnuautaI2CH5REiW2IAq88c9G2UWh tQhQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from; bh=cJdMGzzuf/4dMYkxh7ZkBLCoIaRPjCMHlTSJNnEtUh0=; b=eiAerop4loWUu8hCuOMM1bQgJle1O9MZ9lB3DpltTMfC18gAonDvzzvooJXcpmWYuf 2f5XgglFbqjWeqUJyYkEm/kATO1ISkIbDI7ryV4Cv7P1A4u9RjjxYP9L+wqyjUQgWKWR SNNeR3MXrYsx0kbLsGp7O00Df1fk6WM2u1zSCEUzv9TJ0OgHWDFBKwpmzuALZxlcES3b /M1BynvUtxYEjI+LyRGwSBIAqtp0BjTr2uQDjy43LxRPgzK4D8V1mbJMH2voEr13nPAm Ve/wyesp/9jgsg9pwD/+VUOqAMLAcP2Xdbbvb12O1TahBMNMGVsfB/RckDirX8NH9bjG wk0g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=netdev-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id p20si14157879edi.252.2019.11.18.13.50.02; Mon, 18 Nov 2019 13:50:02 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=netdev-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727140AbfKRVuB (ORCPT + 9 others); Mon, 18 Nov 2019 16:50:01 -0500 Received: from correo.us.es ([193.147.175.20]:45714 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727141AbfKRVte (ORCPT ); Mon, 18 Nov 2019 16:49:34 -0500 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id 5D212EB497 for ; Mon, 18 Nov 2019 22:49:31 +0100 (CET) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 5060AA7EC8 for ; Mon, 18 Nov 2019 22:49:31 +0100 (CET) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id 44189A7EC2; Mon, 18 Nov 2019 22:49:31 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 3753221FE5; Mon, 18 Nov 2019 22:49:26 +0100 (CET) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Mon, 18 Nov 2019 22:49:26 +0100 (CET) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from salvia.here (sys.soleta.eu [212.170.55.40]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id 0739542EE38F; Mon, 18 Nov 2019 22:49:25 +0100 (CET) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org Subject: [PATCH 08/18] netfilter: nft_meta: use 64-bit time arithmetic Date: Mon, 18 Nov 2019 22:49:04 +0100 Message-Id: <20191118214914.142794-9-pablo@netfilter.org> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20191118214914.142794-1-pablo@netfilter.org> References: <20191118214914.142794-1-pablo@netfilter.org> X-Virus-Scanned: ClamAV using ClamSMTP Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Arnd Bergmann On 32-bit architectures, get_seconds() returns an unsigned 32-bit time value, which also matches the type used in the nft_meta code. This will not overflow in year 2038 as a time_t would, but it still suffers from the overflow problem later on in year 2106. Change this instance to use the time64_t type consistently and avoid the deprecated get_seconds(). The nft_meta_weekday() calculation potentially gets a little slower on 32-bit architectures, but now it has the same behavior as on 64-bit architectures and does not overflow. Fixes: 63d10e12b00d ("netfilter: nft_meta: support for time matching") Signed-off-by: Arnd Bergmann Acked-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nft_meta.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) -- 2.11.0 diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 8fd21f436347..8fbea031bd4a 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -33,19 +33,19 @@ static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state); -static u8 nft_meta_weekday(unsigned long secs) +static u8 nft_meta_weekday(time64_t secs) { unsigned int dse; u8 wday; secs -= NFT_META_SECS_PER_MINUTE * sys_tz.tz_minuteswest; - dse = secs / NFT_META_SECS_PER_DAY; + dse = div_u64(secs, NFT_META_SECS_PER_DAY); wday = (4 + dse) % NFT_META_DAYS_PER_WEEK; return wday; } -static u32 nft_meta_hour(unsigned long secs) +static u32 nft_meta_hour(time64_t secs) { struct tm tm; @@ -250,10 +250,10 @@ void nft_meta_get_eval(const struct nft_expr *expr, nft_reg_store64(dest, ktime_get_real_ns()); break; case NFT_META_TIME_DAY: - nft_reg_store8(dest, nft_meta_weekday(get_seconds())); + nft_reg_store8(dest, nft_meta_weekday(ktime_get_real_seconds())); break; case NFT_META_TIME_HOUR: - *dest = nft_meta_hour(get_seconds()); + *dest = nft_meta_hour(ktime_get_real_seconds()); break; default: WARN_ON(1);