[3.13.y-ckt stable] Patch "time: settimeofday: Validate the values of tv from user" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    time: settimeofday: Validate the values of tv from user

to the linux-3.13.y-queue branch of the 3.13.y-ckt extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.13.y-queue

This patch is scheduled to be released in version 3.13.11-ckt16.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.13.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From a9c22cbe4a71a5a76fa1bf9bde38b5d5a2a2e5ff Mon Sep 17 00:00:00 2001
From: Sasha Levin <sasha.levin at oracle.com>
Date: Wed, 3 Dec 2014 19:22:48 -0500
Subject: time: settimeofday: Validate the values of tv from user

commit 6ada1fc0e1c4775de0e043e1bd3ae9d065491aa5 upstream.

An unvalidated user input is multiplied by a constant, which can result in
an undefined behaviour for large values. While this is validated later,
we should avoid triggering undefined behaviour.

Cc: Thomas Gleixner <tglx at linutronix.de>
Cc: Ingo Molnar <mingo at kernel.org>
Signed-off-by: Sasha Levin <sasha.levin at oracle.com>
[jstultz: include trivial milisecond->microsecond correction noticed
by Andy]
Signed-off-by: John Stultz <john.stultz at linaro.org>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 include/linux/time.h | 13 +++++++++++++
 kernel/time.c        |  4 ++++
 2 files changed, 17 insertions(+)

diff --git a/include/linux/time.h b/include/linux/time.h
index d5d229b..1949cd3 100644
--- a/include/linux/time.h
+++ b/include/linux/time.h
@@ -115,6 +115,19 @@ static inline bool timespec_valid_strict(const struct timespec *ts)
 	return true;
 }

+static inline bool timeval_valid(const struct timeval *tv)
+{
+	/* Dates before 1970 are bogus */
+	if (tv->tv_sec < 0)
+		return false;
+
+	/* Can't have more microseconds then a second */
+	if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC)
+		return false;
+
+	return true;
+}
+
 extern bool persistent_clock_exist;

 static inline bool has_persistent_clock(void)
diff --git a/kernel/time.c b/kernel/time.c
index 3c49ab4..3eb322e 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -195,6 +195,10 @@ SYSCALL_DEFINE2(settimeofday, struct timeval __user *, tv,
 	if (tv) {
 		if (copy_from_user(&user_tv, tv, sizeof(*tv)))
 			return -EFAULT;
+
+		if (!timeval_valid(&user_tv))
+			return -EINVAL;
+
 		new_ts.tv_sec = user_tv.tv_sec;
 		new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC;
 	}
--
1.9.1