No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Justin Stitt 5cd98f82ec ntp: Clamp maxerror and esterror to operating range
[ Upstream commit 87d571d6fb77ec342a985afa8744bb9bb75b3622 ]

Using syzkaller alongside the newly reintroduced signed integer overflow
sanitizer spits out this report:

UBSAN: signed-integer-overflow in ../kernel/time/ntp.c:461:16
9223372036854775807 + 500 cannot be represented in type 'long'
Call Trace:
 handle_overflow+0x171/0x1b0
 second_overflow+0x2d6/0x500
 accumulate_nsecs_to_secs+0x60/0x160
 timekeeping_advance+0x1fe/0x890
 update_wall_time+0x10/0x30

time_maxerror is unconditionally incremented and the result is checked
against NTP_PHASE_LIMIT, but the increment itself can overflow, resulting
in wrap-around to negative space.

Before commit eea83d896e ("ntp: NTP4 user space bits update") the user
supplied value was sanity checked to be in the operating range. That change
removed the sanity check and relied on clamping in handle_overflow() which
does not work correctly when the user supplied value is in the overflow
zone of the '+ 500' operation.

The operation requires CAP_SYS_TIME and the side effect of the overflow is
NTP getting out of sync.

Miroslav confirmed that the input value should be clamped to the operating
range and the same applies to time_esterror. The latter is not used by the
kernel, but the value still should be in the operating range as it was
before the sanity check got removed.

Clamp them to the operating range.

[ tglx: Changed it to clamping and included time_esterror ]

Fixes: eea83d896e ("ntp: NTP4 user space bits update")
Signed-off-by: Justin Stitt <justinstitt@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Miroslav Lichvar <mlichvar@redhat.com>
Link: https://lore.kernel.org/all/20240517-b4-sio-ntp-usec-v2-1-d539180f2b79@google.com
Closes: https://github.com/KSPP/linux/issues/354
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ cast things to long long to fix compiler warnings - gregkh ]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-08-19 05:33:51 +02:00
arch arm64: errata: Expand speculative SSBS workaround (again) 2024-08-19 05:33:50 +02:00
block
certs
crypto crypto: ecrdsa - Fix module auto-load on add_key 2024-06-16 13:28:51 +02:00
Documentation arm64: errata: Expand speculative SSBS workaround (again) 2024-08-19 05:33:50 +02:00
drivers scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic 2024-08-19 05:33:51 +02:00
fs ext4: fix wrong unit use in ext4_mb_find_by_goal 2024-08-19 05:33:48 +02:00
include bpf: kprobe: remove unused declaring of bpf_kprobe_override 2024-08-19 05:33:50 +02:00
init
ipc
kernel ntp: Clamp maxerror and esterror to operating range 2024-08-19 05:33:51 +02:00
lib kobject_uevent: Fix OOB access within zap_modalias_env() 2024-08-19 05:33:38 +02:00
LICENSES
mm mm: avoid overflows in dirty throttling logic 2024-08-19 05:33:42 +02:00
net SUNRPC: Fix a race to wake a sync task 2024-08-19 05:33:48 +02:00
samples
scripts kconfig: remove wrong expr_trans_bool() 2024-07-27 10:38:29 +02:00
security apparmor: Fix null pointer deref when receiving skb during sock creation 2024-08-19 05:33:42 +02:00
sound ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 2024-08-19 05:33:51 +02:00
tools selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT 2024-08-19 05:33:47 +02:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.281 2024-07-27 10:38:33 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.