Received: by 2002:ab2:6d45:0:b0:1fb:d597:ff75 with SMTP id d5csp256020lqr; Wed, 5 Jun 2024 05:23:00 -0700 (PDT) X-Forwarded-Encrypted: i=3; AJvYcCUZSs230zca2GmxJ6FCiUHx/xn4Np5ijJVdtYWzAKBOYF9p8kx9slo2uugWrk7/dPnh5wJkwe8BByGaUabaoo+9yCKYMFPSwF1cnSVB3w== X-Google-Smtp-Source: AGHT+IHA1XBBQWgJSdYVa4gT/IsWiMsfk4yrt6ueyI3Ed84uqpsY6T8Iu7/62f24pfjnooXAYOiG X-Received: by 2002:a17:903:120c:b0:1f6:857b:b5c with SMTP id d9443c01a7336-1f6a5a12db5mr28139445ad.32.1717590158896; Wed, 05 Jun 2024 05:22:38 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1717590158; cv=pass; d=google.com; s=arc-20160816; b=MsbF8+20kb2yCJoOMdPIpl1qmoJiGJfhCN/vsZAz7tDs0f2thBryxc7CzxY75npofH mIEEUgzQR1N8tnS81zsMNTBYtmPvmANMWadUWE9wbN4EUqm8VE2/z9bIqWXqzCZt+drl WYSoQEsWb5HRb6p29lKc/ayGZtaE/nD0cQt2pLofzU3HLzLhI3Av5JABQxS3IijF9TLL jQ/TFBTbKqFa8GLVz9Akd/ByTqbBEmOGtNJ/vJ8M5D3D/Q1lj6trEUF8fvo8NhXBifwo E27X+ZW/gRzeTSr7SDEHy0aRVQPI4VrGoT3QAE5MbNa1TChO2LTinTw9cTSlBRgNf2ly FkMQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:cc:to:from:dkim-signature; bh=EddNNtFXmYK/ZbBOTNsinXDBpijxzFng3hifLuCI0/g=; fh=Xjd/OQkm2jBpNVqU6zus7zzmXvF2+eN3fdKj9IAAs8U=; b=gCHOpNDZuzQJb+Zlyc3VgeIm+2/1MKZeNESqMmqATijdqi2hFtr9/GPpBBq3pw/ehK PTpCoBxb1NH9nHJnV8czH9dCyoEDca/rVPL0ffSpTimUy6WhnoijTeKFVc/eN+gp7Kql 1Osd5aOZsWfD/BMPCGICw0o7t5y0J/8L33kubVSHVpGsnk8l0qjsRf0NWFPMsr8LgknH WdhM7yDa3K9Y1CrSCEyAwk0apL4HAzBuKKWoul3Pv5mh7Cw8soVWBIylODUDNLW1JgpI SIVDUTYbZaXYBTsiNkO6/q+IK0FwTMb/wT3IQvTrJAu27labeJ3FMnBfNZw6SQbXCsIZ /mAw==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=sCCEZxpX; arc=pass (i=1 dkim=pass dkdomain=kernel.org); spf=pass (google.com: domain of linux-kernel+bounces-202395-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-202395-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [2604:1380:45e3:2400::1]) by mx.google.com with ESMTPS id d9443c01a7336-1f6323e9eedsi19521865ad.364.2024.06.05.05.22.38 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 05 Jun 2024 05:22:38 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel+bounces-202395-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=sCCEZxpX; arc=pass (i=1 dkim=pass dkdomain=kernel.org); spf=pass (google.com: domain of linux-kernel+bounces-202395-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-202395-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id D6CDE289953 for ; Wed, 5 Jun 2024 12:14:10 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 5AA55197A6A; Wed, 5 Jun 2024 11:54:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="sCCEZxpX" Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 81F151974FF; Wed, 5 Jun 2024 11:54:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717588463; cv=none; b=Pbssk+kQKguUV9/+Uexxy2dvTn+0DHK4KWXpFVS+QTuMctmMY/GNNd4Ai3ynT5u/Lw5l/4bGAL9xQ4w34fHiGSp2cc4KPei1BcpH5IyRE8jp4hXBp1Pw7KwNEnbyJJYGKjgon2Wnk8uU1Jx1nTCU6ToGePuo8xTOOUcffqPOua0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717588463; c=relaxed/simple; bh=vZPl2Rg9MMjHgwCnAcC6p7mvcU/vcb8ipMfTFMNDETU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dY9y6dh7AO5V95QV9uA9RhIePorSNhg/1nbf7gWcxSmyUYnhiHZdz59BqjnSPMqkI5X+9n4tegqe/gyguzUW8LalnIIxCZiiQZyS3HWpYq8mLZVr7hTpEpqcIuoPl5M+XblAsPnR/vxmoAXDqzoE5TKle4YNRfddxIzoh5DSNgw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=sCCEZxpX; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5B370C32786; Wed, 5 Jun 2024 11:54:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1717588463; bh=vZPl2Rg9MMjHgwCnAcC6p7mvcU/vcb8ipMfTFMNDETU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sCCEZxpX/zWeYEK3nmS5lRZLp+TQPa1lEiufq2I+ByLxGgLXTDPBG5GJhS56X4plj AKn+h43iyMM/fS7m/n2TkCEH6f1MODQ5scUeiuxqWXGgwo+jLV35VUVhLiD22fJjf9 OV/ZE+wq+Gpiro0YUYLZDQHU7zyOp+TI1ki11ZQ3Vjd9a3g3xPvCLs7c1QnymOAR9o x53FvQaUQ18IDZzVZq491udQzTVSBiAaJ6Ac9vyra3/R2rAbaCWr1K1m/5IZM2t4BZ Tnibv6SUEOQeFQ1CMpBkrP29GgVg2m9MV8gR50W36XLaV2Su3L/SkGbFdGKw1CKEBh FkKiUWct5fwcg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Roman Smirnov , Jan Kara , Sergey Shtylyov , Sasha Levin , jack@suse.com Subject: [PATCH AUTOSEL 5.15 4/9] udf: udftime: prevent overflow in udf_disk_stamp_to_time() Date: Wed, 5 Jun 2024 07:54:02 -0400 Message-ID: <20240605115415.2964165-4-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240605115415.2964165-1-sashal@kernel.org> References: <20240605115415.2964165-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 5.15.160 Content-Transfer-Encoding: 8bit From: Roman Smirnov [ Upstream commit 3b84adf460381169c085e4bc09e7b57e9e16db0a ] An overflow can occur in a situation where src.centiseconds takes the value of 255. This situation is unlikely, but there is no validation check anywere in the code. Found by Linux Verification Center (linuxtesting.org) with Svace. Suggested-by: Jan Kara Signed-off-by: Roman Smirnov Reviewed-by: Sergey Shtylyov Signed-off-by: Jan Kara Message-Id: <20240327132755.13945-1-r.smirnov@omp.ru> Signed-off-by: Sasha Levin --- fs/udf/udftime.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fs/udf/udftime.c b/fs/udf/udftime.c index fce4ad976c8c2..26169b1f482c3 100644 --- a/fs/udf/udftime.c +++ b/fs/udf/udftime.c @@ -60,13 +60,18 @@ udf_disk_stamp_to_time(struct timespec64 *dest, struct timestamp src) dest->tv_sec = mktime64(year, src.month, src.day, src.hour, src.minute, src.second); dest->tv_sec -= offset * 60; - dest->tv_nsec = 1000 * (src.centiseconds * 10000 + - src.hundredsOfMicroseconds * 100 + src.microseconds); + /* * Sanitize nanosecond field since reportedly some filesystems are * recorded with bogus sub-second values. */ - dest->tv_nsec %= NSEC_PER_SEC; + if (src.centiseconds < 100 && src.hundredsOfMicroseconds < 100 && + src.microseconds < 100) { + dest->tv_nsec = 1000 * (src.centiseconds * 10000 + + src.hundredsOfMicroseconds * 100 + src.microseconds); + } else { + dest->tv_nsec = 0; + } } void -- 2.43.0