LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Arnd Bergmann <arnd@arndb.de>
To: y2038@lists.linaro.org,
	Sudip Mukherjee <sudipm.mukherjee@gmail.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-kernel@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>,
	stable@vger.kernel.org,
	Bamvor Jian Zhang <bamvor.zhangjian@linaro.org>,
	"Michael S. Tsirkin" <mst@redhat.com>,
	Thomas Gleixner <tglx@linutronix.de>
Subject: [PATCH 7/8] ppdev: fix PPGETTIME/PPSETTIME ioctls
Date: Fri,  8 Nov 2019 21:34:30 +0100
Message-ID: <20191108203435.112759-8-arnd@arndb.de> (raw)
In-Reply-To: <20191108203435.112759-1-arnd@arndb.de>

Going through the uses of timeval in the user space API,
I noticed two bugs in ppdev that were introduced in the y2038
conversion:

* The range check was accidentally moved from ppsettime to
  ppgettime

* On sparc64, the microseconds are in the other half of the
  64-bit word.

Fix both, and mark the fix for stable backports.

Cc: stable@vger.kernel.org
Fixes: 3b9ab374a1e6 ("ppdev: convert to y2038 safe")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 drivers/char/ppdev.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index c86f18aa8985..34bb88fe0b0a 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -619,20 +619,27 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 		if (copy_from_user(time32, argp, sizeof(time32)))
 			return -EFAULT;
 
+		if ((time32[0] < 0) || (time32[1] < 0))
+			return -EINVAL;
+
 		return pp_set_timeout(pp->pdev, time32[0], time32[1]);
 
 	case PPSETTIME64:
 		if (copy_from_user(time64, argp, sizeof(time64)))
 			return -EFAULT;
 
+		if ((time64[0] < 0) || (time64[1] < 0))
+			return -EINVAL;
+
+		if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall())
+			time64[1] >>= 32;
+
 		return pp_set_timeout(pp->pdev, time64[0], time64[1]);
 
 	case PPGETTIME32:
 		jiffies_to_timespec64(pp->pdev->timeout, &ts);
 		time32[0] = ts.tv_sec;
 		time32[1] = ts.tv_nsec / NSEC_PER_USEC;
-		if ((time32[0] < 0) || (time32[1] < 0))
-			return -EINVAL;
 
 		if (copy_to_user(argp, time32, sizeof(time32)))
 			return -EFAULT;
@@ -643,8 +650,9 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 		jiffies_to_timespec64(pp->pdev->timeout, &ts);
 		time64[0] = ts.tv_sec;
 		time64[1] = ts.tv_nsec / NSEC_PER_USEC;
-		if ((time64[0] < 0) || (time64[1] < 0))
-			return -EINVAL;
+
+		if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall())
+			time64[1] <<= 32;
 
 		if (copy_to_user(argp, time64, sizeof(time64)))
 			return -EFAULT;
-- 
2.20.0


  parent reply index

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-11-08 20:34 [PATCH 0/8] y2038: bug fixes from y2038 work Arnd Bergmann
2019-11-08 20:34 ` [PATCH 1/8] y2038: timex: remove incorrect time_t truncation Arnd Bergmann
2019-11-10 20:44   ` Deepa Dinamani
2019-11-12  7:16   ` [tip: timers/urgent] ntp/y2038: Remove " tip-bot2 for Arnd Bergmann
2019-11-08 20:34 ` [PATCH 2/8] timekeeping: optimize ns_to_timespec64 Arnd Bergmann
2019-11-10 20:46   ` Deepa Dinamani
2019-11-12  7:22   ` [tip: timers/core] time: Optimize ns_to_timespec64() tip-bot2 for Arnd Bergmann
2019-11-08 20:34 ` [PATCH 3/8] powerpc: fix vdso32 for ppc64le Arnd Bergmann
2019-11-20 19:13   ` [Y2038] " Ben Hutchings
2019-11-20 19:35     ` Arnd Bergmann
2019-11-20 21:49       ` Ben Hutchings
2019-11-21 10:02         ` Arnd Bergmann
2019-11-21 15:56           ` Ben Hutchings
2019-11-08 20:34 ` [PATCH 4/8] ipmi: kill off 'timespec' usage again Arnd Bergmann
2019-11-08 22:11   ` Corey Minyard
2019-11-09 11:23     ` Arnd Bergmann
2019-11-08 20:34 ` [PATCH 5/8] netfilter: xt_time: use time64_t Arnd Bergmann
2019-11-15 22:43   ` Pablo Neira Ayuso
2019-11-08 20:34 ` [PATCH 6/8] lp: fix sparc64 LPSETTIMEOUT ioctl Arnd Bergmann
2019-11-20 19:27   ` [Y2038] " Ben Hutchings
2019-11-20 19:46     ` Arnd Bergmann
2019-11-20 22:10       ` Ben Hutchings
2019-11-21 14:04         ` Arnd Bergmann
2019-11-21 16:00           ` Ben Hutchings
2019-11-08 20:34 ` Arnd Bergmann [this message]
2019-11-20 19:29   ` [Y2038] [PATCH 7/8] ppdev: fix PPGETTIME/PPSETTIME ioctls Ben Hutchings
2019-11-21 14:06     ` Arnd Bergmann
2019-11-08 20:34 ` [PATCH 8/8] Input: input_event: fix struct padding on sparc64 Arnd Bergmann
2019-11-11 18:28   ` Dmitry Torokhov
2019-11-11 19:18     ` Arnd Bergmann

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191108203435.112759-8-arnd@arndb.de \
    --to=arnd@arndb.de \
    --cc=bamvor.zhangjian@linaro.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mst@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=sudipm.mukherjee@gmail.com \
    --cc=tglx@linutronix.de \
    --cc=y2038@lists.linaro.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
	git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git