Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

select: deal with math overflow from borderline valid userland data

Some userland apps seem to pass in a "0" for the seconds, and several
seconds worth of usecs to select(). The old kernels accepted this just
fine, so the new kernels must too.

However, due to the upscaling of the microseconds to nanoseconds we had
some cases where we got math overflow, and depending on the GCC version
(due to inlining decisions) that actually resulted in an -EINVAL return.

This patch fixes this by adding the excess microseconds to the seconds
field.

Also with thanks to Marcin Slusarz for spotting some implementation bugs
in the diagnostics patches.

Reported-by: Carlos R. Mafra <crmafra2@gmail.com>
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Arjan van de Ven and committed by
Linus Torvalds
4d36a9e6 44a504c4

+6 -4
+3 -2
fs/compat.c
··· 1684 1684 return -EFAULT; 1685 1685 1686 1686 to = &end_time; 1687 - if (poll_select_set_timeout(to, tv.tv_sec, 1688 - tv.tv_usec * NSEC_PER_USEC)) 1687 + if (poll_select_set_timeout(to, 1688 + tv.tv_sec + (tv.tv_usec / USEC_PER_SEC), 1689 + (tv.tv_usec % USEC_PER_SEC) * NSEC_PER_USEC)) 1689 1690 return -EINVAL; 1690 1691 } 1691 1692
+3 -2
fs/select.c
··· 519 519 return -EFAULT; 520 520 521 521 to = &end_time; 522 - if (poll_select_set_timeout(to, tv.tv_sec, 523 - tv.tv_usec * NSEC_PER_USEC)) 522 + if (poll_select_set_timeout(to, 523 + tv.tv_sec + (tv.tv_usec / USEC_PER_SEC), 524 + (tv.tv_usec % USEC_PER_SEC) * NSEC_PER_USEC)) 524 525 return -EINVAL; 525 526 } 526 527