No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Justin Stitt 3f16bc776b ntp: Safeguard against time_constant overflow
commit 06c03c8edce333b9ad9c6b207d93d3a5ae7c10c0 upstream.

Using syzkaller with the recently reintroduced signed integer overflow
sanitizer produces this UBSAN report:

UBSAN: signed-integer-overflow in ../kernel/time/ntp.c:738:18
9223372036854775806 + 4 cannot be represented in type 'long'
Call Trace:
 handle_overflow+0x171/0x1b0
 __do_adjtimex+0x1236/0x1440
 do_adjtimex+0x2be/0x740

The user supplied time_constant value is incremented by four and then
clamped to the operating range.

Before commit eea83d896e ("ntp: NTP4 user space bits update") the user
supplied value was sanity checked to be in the operating range. That change
removed the sanity check and relied on clamping after incrementing which
does not work correctly when the user supplied value is in the overflow
zone of the '+ 4' operation.

The operation requires CAP_SYS_TIME and the side effect of the overflow is
NTP getting out of sync.

Similar to the fixups for time_maxerror and time_esterror, clamp the user
space supplied value to the operating range.

[ tglx: Switch to clamping ]

Fixes: eea83d896e ("ntp: NTP4 user space bits update")
Signed-off-by: Justin Stitt <justinstitt@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Miroslav Lichvar <mlichvar@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20240517-b4-sio-ntp-c-v2-1-f3a80096f36f@google.com
Closes: https://github.com/KSPP/linux/issues/352
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-08-19 05:33:52 +02:00
arch arm64: errata: Expand speculative SSBS workaround (again) 2024-08-19 05:33:50 +02:00
block block: prevent division by zero in blk_rq_stat_sum() 2024-04-13 12:51:38 +02:00
certs
crypto crypto: ecrdsa - Fix module auto-load on add_key 2024-06-16 13:28:51 +02:00
Documentation arm64: errata: Expand speculative SSBS workaround (again) 2024-08-19 05:33:50 +02:00
drivers driver core: Fix uevent_show() vs driver detach race 2024-08-19 05:33:52 +02:00
fs ext4: fix wrong unit use in ext4_mb_find_by_goal 2024-08-19 05:33:48 +02:00
include bpf: kprobe: remove unused declaring of bpf_kprobe_override 2024-08-19 05:33:50 +02:00
init init: open /initrd.image with O_LARGEFILE 2024-04-13 12:51:36 +02:00
ipc
kernel ntp: Safeguard against time_constant overflow 2024-08-19 05:33:52 +02:00
lib kobject_uevent: Fix OOB access within zap_modalias_env() 2024-08-19 05:33:38 +02:00
LICENSES
mm mm: avoid overflows in dirty throttling logic 2024-08-19 05:33:42 +02:00
net SUNRPC: Fix a race to wake a sync task 2024-08-19 05:33:48 +02:00
samples media: rename VFL_TYPE_GRABBER to _VIDEO 2024-03-26 18:22:22 -04:00
scripts kconfig: remove wrong expr_trans_bool() 2024-07-27 10:38:29 +02:00
security apparmor: Fix null pointer deref when receiving skb during sock creation 2024-08-19 05:33:42 +02:00
sound ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 2024-08-19 05:33:51 +02:00
tools selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT 2024-08-19 05:33:47 +02:00
usr
virt KVM: async_pf: Cleanup kvm_setup_async_pf() 2024-05-02 16:18:32 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS iio: stx104: Move to addac subdirectory 2023-08-30 16:27:12 +02:00
Makefile Linux 5.4.281 2024-07-27 10:38:33 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.