Module Name:    src
Committed By:   nia
Date:           Thu Mar 18 14:01:18 UTC 2021

Modified Files:
        src/sys/kern: subr_time.c

Log Message:
ts2timo(9): refactor TIMER_ABSTIME handling

- only use *start for output of the original time.
  for clarity purposes, use the temporary variable for everything else.
- add a check for integer underflow

Reported-by: syzbot+17b5072d5ed262a96...@syzkaller.appspotmail.com


To generate a diff of this commit:
cvs rdiff -u -r1.28 -r1.29 src/sys/kern/subr_time.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/kern/subr_time.c
diff -u src/sys/kern/subr_time.c:1.28 src/sys/kern/subr_time.c:1.29
--- src/sys/kern/subr_time.c:1.28	Thu Mar 18 13:45:15 2021
+++ src/sys/kern/subr_time.c	Thu Mar 18 14:01:18 2021
@@ -1,4 +1,4 @@
-/*	$NetBSD: subr_time.c,v 1.28 2021/03/18 13:45:15 nia Exp $	*/
+/*	$NetBSD: subr_time.c,v 1.29 2021/03/18 14:01:18 nia Exp $	*/
 
 /*
  * Copyright (c) 1982, 1986, 1989, 1993
@@ -33,7 +33,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: subr_time.c,v 1.28 2021/03/18 13:45:15 nia Exp $");
+__KERNEL_RCSID(0, "$NetBSD: subr_time.c,v 1.29 2021/03/18 14:01:18 nia Exp $");
 
 #include <sys/param.h>
 #include <sys/kernel.h>
@@ -332,17 +332,20 @@ ts2timo(clockid_t clock_id, int flags, s
 	if (ts->tv_nsec < 0 || ts->tv_nsec >= 1000000000L)
 		return EINVAL;
 
-	if (start == NULL)
-		start = &tsd;
-
-	if (flags != TIMER_RELTIME || start != &tsd) {
-		error = clock_gettime1(clock_id, start);
+	if (flags == TIMER_ABSTIME || start != NULL) {
+		error = clock_gettime1(clock_id, &tsd);
 		if (error != 0)
 			return error;
+		if (start != NULL)
+			*start = tsd;
 	}
 
-	if (flags != TIMER_RELTIME)
-		timespecsub(ts, start, ts);
+	if (flags == TIMER_ABSTIME) {
+		if ((tsd.tv_sec > 0 && ts->tv_sec < LLONG_MIN + tsd.tv_sec) ||
+		    (tsd.tv_sec < 0 && ts->tv_sec > LLONG_MAX + tsd.tv_sec))
+			return EINVAL;
+		timespecsub(ts, &tsd, ts);
+	}
 
 	error = itimespecfix(ts);
 	if (error != 0)

Reply via email to