redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity
remarkable-linux/kernel
History
Thomas Gleixner a4dbaf7c2d alarmtimer: Prevent overflow for relative nanosleep 
[ Upstream commit 5f936e19cc ]

Air Icy reported:

  UBSAN: Undefined behaviour in kernel/time/alarmtimer.c:811:7
  signed integer overflow:
  1529859276030040771 + 9223372036854775807 cannot be represented in type 'long long int'
  Call Trace:
   alarm_timer_nsleep+0x44c/0x510 kernel/time/alarmtimer.c:811
   __do_sys_clock_nanosleep kernel/time/posix-timers.c:1235 [inline]
   __se_sys_clock_nanosleep kernel/time/posix-timers.c:1213 [inline]
   __x64_sys_clock_nanosleep+0x326/0x4e0 kernel/time/posix-timers.c:1213
   do_syscall_64+0xb8/0x3a0 arch/x86/entry/common.c:290

alarm_timer_nsleep() uses ktime_add() to add the current time and the
relative expiry value. ktime_add() has no sanity checks so the addition
can overflow when the relative timeout is large enough.

Use ktime_add_safe() which has the necessary sanity checks in place and
limits the result to the valid range.

Fixes: 9a7adcf5c6 ("timers: Posix interface for alarm-timers")
Reported-by: Team OWL337 <icytxw@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: John Stultz <john.stultz@linaro.org>
Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1807020926360.1595@nanos.tec.linutronix.de
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-03 17:00:49 -07:00
..
bpf bpf: hash map: decrement counter on error 2018-08-24 13:09:12 +02:00
cgroup cgroup: fix rule checking for threaded mode switching 2018-03-28 18:24:37 +02:00
configs
debug kdb: make "mdr" command repeat 2018-05-30 07:52:41 +02:00
events perf/core: Force USER_DS when recording user stack data 2018-09-26 08:38:08 +02:00
gcov License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
irq genirq: Make force irq threading setup more robust 2018-08-09 12:16:38 +02:00
livepatch livepatch: Validate module/old func name length 2018-09-09 19:55:58 +02:00
locking locking/rtmutex: Allow specifying a subclass for nested locking 2018-09-05 09:26:29 +02:00
power PM / sleep: wakeup: Fix build error caused by missing SRCU support 2018-09-09 19:55:58 +02:00
printk printk/tracing: Do not trace printk_nmi_enter() 2018-09-09 19:55:57 +02:00
rcu rcu: Call touch_nmi_watchdog() while printing stall warnings 2018-05-30 07:52:39 +02:00
sched sched/fair: Fix vruntime_normalized() for remote non-migration wakeup 2018-09-29 03:06:07 -07:00
time alarmtimer: Prevent overflow for relative nanosleep 2018-10-03 17:00:49 -07:00
trace ring-buffer: Allow for rescheduling when removing pages 2018-09-29 03:06:04 -07:00
.gitignore
acct.c kernel/acct.c: fix the acct->needcheck check in check_free_space() 2018-01-10 09:31:17 +01:00
async.c kernel/async.c: revert "async: simplify lowest_in_progress()" 2018-02-16 20:23:05 +01:00
audit.c audit: return on memory error to avoid null pointer dereference 2018-05-30 07:52:39 +02:00
audit.h
audit_fsnotify.c
audit_tree.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
audit_watch.c audit: fix use-after-free in audit_add_watch 2018-09-26 08:38:09 +02:00
auditfilter.c audit: allow not equal op for audit by executable 2018-08-03 07:50:39 +02:00
auditsc.c audit: fix potential null dereference 'context->module.name' 2018-08-06 16:20:49 +02:00
backtracetest.c
bounds.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
capability.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
compat.c compat: fix 4-byte infoleak via uninitialized struct field 2018-05-16 10:10:26 +02:00
configs.c
context_tracking.c
cpu.c cpu/hotplug: Prevent state corruption on error rollback 2018-09-19 22:43:36 +02:00
cpu_pm.c
crash_core.c kdump: write correct address of mem_section into vmcoreinfo 2018-01-17 09:45:27 +01:00
crash_dump.c
cred.c
delayacct.c delayacct: Use raw_spinlocks 2018-08-03 07:50:38 +02:00
dma.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
elfcore.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
exec_domain.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
exit.c kernel/exit.c: export abort() to modules 2018-02-13 10:19:49 +01:00
extable.c
fork.c fork: don't copy inconsistent signal handler state to child 2018-09-15 09:45:27 +02:00
freezer.c
futex.c futex: Fix OWNER_DEAD fixup 2018-02-03 17:38:47 +01:00
futex_compat.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
groups.c kernel: make groups_sort calling a responsibility group_info allocators 2017-12-20 10:10:18 +01:00
hung_task.c kernel/hung_task.c: show all hung tasks before panic 2018-08-03 07:50:23 +02:00
irq_work.c
jump_label.c jump_label: Invoke jump_label_test() via early_initcall() 2017-12-14 09:53:13 +01:00
kallsyms.c
kcmp.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks locking/mutex: Allow MUTEX_SPIN_ON_OWNER when DEBUG_MUTEXES 2016-10-25 11:31:51 +02:00
Kconfig.preempt
kcov.c kcov: ensure irq code sees a valid area 2018-08-03 07:50:22 +02:00
kexec.c
kexec_core.c
kexec_file.c
kexec_internal.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
kmod.c
kprobes.c kprobes: Make list and blacklist root user read only 2018-09-05 09:26:41 +02:00
ksysfs.c
kthread.c kthread, tracing: Don't expose half-written comm when creating kthreads 2018-08-03 07:50:21 +02:00
latencytop.c
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
memremap.c mm: Fix devm_memremap_pages() collision handling 2018-09-15 09:45:35 +02:00
module-internal.h
module.c init: fix false positives in W+X checking 2018-06-21 04:02:57 +09:00
module_signing.c
notifier.c
nsproxy.c
padata.c
panic.c
params.c
pid.c
pid_namespace.c
profile.c
ptrace.c
range.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
reboot.c
relay.c kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE 2018-05-30 07:52:00 +02:00
resource.c resource: fix integer overflow at reallocation 2018-04-24 09:36:22 +02:00
seccomp.c seccomp: Move speculation migitation control to arch code 2018-05-22 18:54:04 +02:00
signal.c sched/core: Introduce set_special_state() 2018-06-21 04:02:54 +09:00
smp.c cpu/hotplug: Fix SMT supported evaluation 2018-08-15 18:13:00 +02:00
smpboot.c
smpboot.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
softirq.c Mark HI and TASKLET softirq synchronous 2018-08-15 18:12:47 +02:00
stacktrace.c
stop_machine.c stop_machine: Atomically queue and wake stopper threads 2018-09-05 09:26:36 +02:00
sys.c sys: don't hold uts_sem while accessing userspace memory 2018-09-09 19:56:00 +02:00
sys_ni.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
sysctl.c kmemcheck: rip it out 2018-02-22 15:42:24 +01:00
sysctl_binary.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
task_work.c locking/barriers: Convert users of lockless_dereference() to READ_ONCE() 2017-12-25 14:26:21 +01:00
taskstats.c
test_kprobes.c
torture.c
tracepoint.c tracepoint: Do not warn on ENOMEM 2018-05-09 09:51:50 +02:00
tsacct.c
ucount.c ucount: Remove the atomicity from ucount->count 2017-03-06 15:26:37 -06:00
uid16.c kernel: make groups_sort calling a responsibility group_info allocators 2017-12-20 10:10:18 +01:00
umh.c
up.c
user-return-notifier.c
user.c
user_namespace.c userns: move user access out of the mutex 2018-09-09 19:56:00 +02:00
utsname.c
utsname_sysctl.c sys: don't hold uts_sem while accessing userspace memory 2018-09-09 19:56:00 +02:00
watchdog.c watchdog: Mark watchdog touch functions as notrace 2018-09-05 09:26:42 +02:00
watchdog_hld.c watchdog: Mark watchdog touch functions as notrace 2018-09-05 09:26:42 +02:00
workqueue.c watchdog: Mark watchdog touch functions as notrace 2018-09-05 09:26:42 +02:00
workqueue_internal.h Merge branch 'for-4.14-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq 2017-11-06 12:26:49 -08:00