From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE06CC43215 for ; Wed, 20 Nov 2019 19:29:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A075B20715 for ; Wed, 20 Nov 2019 19:29:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727787AbfKTT3g (ORCPT ); Wed, 20 Nov 2019 14:29:36 -0500 Received: from imap1.codethink.co.uk ([176.9.8.82]:34311 "EHLO imap1.codethink.co.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727090AbfKTT3g (ORCPT ); Wed, 20 Nov 2019 14:29:36 -0500 Received: from [167.98.27.226] (helo=xylophone) by imap1.codethink.co.uk with esmtpsa (Exim 4.84_2 #1 (Debian)) id 1iXVfQ-0002UZ-9S; Wed, 20 Nov 2019 19:29:32 +0000 Message-ID: Subject: Re: [Y2038] [PATCH 7/8] ppdev: fix PPGETTIME/PPSETTIME ioctls From: Ben Hutchings To: Arnd Bergmann , y2038@lists.linaro.org, Sudip Mukherjee , Greg Kroah-Hartman Cc: "Michael S. Tsirkin" , linux-kernel@vger.kernel.org, stable@vger.kernel.org, Thomas Gleixner , Bamvor Jian Zhang Date: Wed, 20 Nov 2019 19:29:31 +0000 In-Reply-To: <20191108203435.112759-8-arnd@arndb.de> References: <20191108203435.112759-1-arnd@arndb.de> <20191108203435.112759-8-arnd@arndb.de> Organization: Codethink Ltd. Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.30.5-1.1 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2019-11-08 at 21:34 +0100, Arnd Bergmann wrote: > Going through the uses of timeval in the user space API, > I noticed two bugs in ppdev that were introduced in the y2038 > conversion: > > * The range check was accidentally moved from ppsettime to > ppgettime > > * On sparc64, the microseconds are in the other half of the > 64-bit word. > > Fix both, and mark the fix for stable backports. Like the patch for lpdev, this also doesn't completely fix sparc64. Ben. > Cc: stable@vger.kernel.org > Fixes: 3b9ab374a1e6 ("ppdev: convert to y2038 safe") > Signed-off-by: Arnd Bergmann > --- > drivers/char/ppdev.c | 16 ++++++++++++---- > 1 file changed, 12 insertions(+), 4 deletions(-) > > diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c > index c86f18aa8985..34bb88fe0b0a 100644 > --- a/drivers/char/ppdev.c > +++ b/drivers/char/ppdev.c > @@ -619,20 +619,27 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg) > if (copy_from_user(time32, argp, sizeof(time32))) > return -EFAULT; > > + if ((time32[0] < 0) || (time32[1] < 0)) > + return -EINVAL; > + > return pp_set_timeout(pp->pdev, time32[0], time32[1]); > > case PPSETTIME64: > if (copy_from_user(time64, argp, sizeof(time64))) > return -EFAULT; > > + if ((time64[0] < 0) || (time64[1] < 0)) > + return -EINVAL; > + > + if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall()) > + time64[1] >>= 32; > + > return pp_set_timeout(pp->pdev, time64[0], time64[1]); > > case PPGETTIME32: > jiffies_to_timespec64(pp->pdev->timeout, &ts); > time32[0] = ts.tv_sec; > time32[1] = ts.tv_nsec / NSEC_PER_USEC; > - if ((time32[0] < 0) || (time32[1] < 0)) > - return -EINVAL; > > if (copy_to_user(argp, time32, sizeof(time32))) > return -EFAULT; > @@ -643,8 +650,9 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg) > jiffies_to_timespec64(pp->pdev->timeout, &ts); > time64[0] = ts.tv_sec; > time64[1] = ts.tv_nsec / NSEC_PER_USEC; > - if ((time64[0] < 0) || (time64[1] < 0)) > - return -EINVAL; > + > + if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall()) > + time64[1] <<= 32; > > if (copy_to_user(argp, time64, sizeof(time64))) > return -EFAULT; -- Ben Hutchings, Software Developer Codethink Ltd https://www.codethink.co.uk/ Dale House, 35 Dale Street Manchester, M1 2HF, United Kingdom