LKML Archive on
 help / color / Atom feed
From: John Stultz <>
To: lkml <>
Cc: John Stultz <>,
	Thomas Gleixner <>,
	Ingo Molnar <>,
	Sasha Levin <>,
Subject: [RESEND][PATCH v2] ntp: Fixup adjtimex freq validation on 32bit systems
Date: Mon,  9 Feb 2015 23:30:36 -0800
Message-ID: <> (raw)

For tip/timers/urgent

Additional validation of adjtimex freq values to avoid
potential multiplication overflows were added in commit
5e5aeb4367b (time: adjtimex: Validate the ADJ_FREQUENCY values)

Unfortunately the patch used LONG_MAX/MIN instead of
LLONG_MAX/MIN, which was fine on 64bit systems, but being
much smaller on 32bit systems caused false positives
resulting in most direct frequency adjustments to fail w/

ntpd only does direct frequency adjustments at startup, so
the issue was not as easily observed there, but other time
sync applications like ptpd and chrony were more effected by
the bug.

See bugs:

This patch changes the checks to use LLONG_MAX for
clarity, and additionally the checks are disabled
on 32bit systems since LLONG_MAX/PPM_SCALE is always
larger then the 32bit long freq value, so mult
overflows aren't possible there.

Cc: Thomas Gleixner <>
Cc: Ingo Molnar <>
Cc: Sasha Levin <>
Reported-by: Josh Boyer <>
Reported-by: George Joseph <>
Tested-by: George Joseph <>
Signed-off-by: John Stultz <>
v2: Included the BITS_PER_LONG check to disable
the check on 32bit systems, since it generates
build warnings in some settings.

 kernel/time/ntp.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 4b585e0..35b25d0 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -633,10 +633,14 @@ int ntp_validate_timex(struct timex *txc)
 	if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME)))
 		return -EPERM;
-	if (txc->modes & ADJ_FREQUENCY) {
-		if (LONG_MIN / PPM_SCALE > txc->freq)
+	/*
+	 * Check for potential mult overflows that can
+	 * only happen on 64bit systems.
+	 */
+	if ((txc->modes & ADJ_FREQUENCY) && (BITS_PER_LONG == 64)) {
+		if (LLONG_MIN / PPM_SCALE > txc->freq)
 			return -EINVAL;
-		if (LONG_MAX / PPM_SCALE < txc->freq)
+		if (LLONG_MAX / PPM_SCALE < txc->freq)
 			return -EINVAL;

             reply index

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-02-10  7:30 John Stultz [this message]
2015-02-18 17:07 ` [tip:timers/urgent] ntp: Fixup adjtimex freq validation on 32-bit systems tip-bot for John Stultz

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on

Archives are clonable:
	git clone --mirror lkml/git/0.git
	git clone --mirror lkml/git/1.git
	git clone --mirror lkml/git/2.git
	git clone --mirror lkml/git/3.git
	git clone --mirror lkml/git/4.git
	git clone --mirror lkml/git/5.git
	git clone --mirror lkml/git/6.git
	git clone --mirror lkml/git/7.git
	git clone --mirror lkml/git/8.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ \
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone