From nobody Mon Jun 8 05:26:39 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9A5E13A5E6F; Tue, 2 Jun 2026 19:13:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780427631; cv=none; b=kOCcT6qSwTnfg9tssJG8c1tLTf8qzHe5q2fyR7h9L1O2ZZGi0dFAZIU+YntVWyRxAprpNegjPAkIHvmtuE3SZBld3L4T6Dqo9wamFrUuiEpcQ1Gw1T+AVCnvM3B6VF3sx7JqvojzjBXswTOYVeb2IQfAx3oFh4sjbay+Our8wa4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780427631; c=relaxed/simple; bh=GojDjKfaddEubm2ZaqSJstbt4W4xM+KbTebsnKxQlRs=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=p9k+ovvDSdfng58HMhVlrFADtRseWuEBxIxRoNNSYlMXf6Gqeu5hS4D11dyqRWeNJdn4f4Fc+J/owlcubCFfmI6n8OxYiZmXA4PcHxHO0KClXErV+LKFtMGUtGQTG3TyqwqpAQpd6V1nDN53HBu70Nwbub28PmUNOmUlHKb+5bU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=ArU7UNNI; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=Ckp/Lv6F; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="ArU7UNNI"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="Ckp/Lv6F" Date: Tue, 02 Jun 2026 19:13:47 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1780427629; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=B5c2l5uzPJN61Z1MCZkO2G8nlG2n7WZJ0tHGkJByehA=; b=ArU7UNNIKtPZYZDjzuXJYUunyNgbs9yZwk8vCVDDx+x5fTwhx8RCMyVkInJ8QBwg1z2Y/g fbxwwz5WL3gOYnmGmOMFMc/QEXTxumR2RMA8tcTC4cuBISh0I7OA7MxjY2vV2iAq/3pb+i vrlQemzAwijzYm+HXAf74myAdhFlrb+ngFztH7rsfPYPQ2C9x7HrFteiT1pO+1hUiXP+bD IyhESnNNoZZgfDdYwakiFpPWp7DoQwFoURl6WvtgLY7LBvceBKacv7SlphhFJduBhyN9nG KaXyij3C3GzO3V/6plqr55y54mO6DbFGtP5cDcssntKk/Ogy+2Ueth3wamPkXg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1780427629; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=B5c2l5uzPJN61Z1MCZkO2G8nlG2n7WZJ0tHGkJByehA=; b=Ckp/Lv6FONbw/nqtY2MhsysdvD3VwoKM5vW2aHUH+/rKiyHnuqs0wbJbWTXCj2VStrAut1 bGomKhkI5KUnwHDQ== From: "tip-bot2 for Naveen Kumar Chaudhary" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: timers/urgent] time: Fix off-by-one in settimeofday() usec validation Cc: Naveen Kumar Chaudhary , Thomas Gleixner , John Stultz , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <4rikk44zew3s6577dugmx4jyblz7o5c57niuap6ct3td5yfm6w@gh7pcumg7qor> References: <4rikk44zew3s6577dugmx4jyblz7o5c57niuap6ct3td5yfm6w@gh7pcumg7qor> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <178042762760.710.13782923240074309960.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the timers/urgent branch of tip: Commit-ID: ce4abda5e12622f33450159e76c8f56d28d7f03d Gitweb: https://git.kernel.org/tip/ce4abda5e12622f33450159e76c8f56d2= 8d7f03d Author: Naveen Kumar Chaudhary AuthorDate: Tue, 02 Jun 2026 23:37:37 +05:30 Committer: Thomas Gleixner CommitterDate: Tue, 02 Jun 2026 21:07:55 +02:00 time: Fix off-by-one in settimeofday() usec validation The validation check uses '>' instead of '>=3D' when comparing tv_usec against USEC_PER_SEC, allowing the value 1000000 through. After conversion to nanoseconds (*=3D 1000), this produces tv_nsec =3D=3D NSEC_PER_SEC, violating the timespec invariant that tv_nsec must be less than NSEC_PER_SEC. Use '>=3D' to reject tv_usec values that are not in the valid range of 0 to 999999. Fixes: 5e0fb1b57bea ("y2038: time: avoid timespec usage in settimeofday()") Signed-off-by: Naveen Kumar Chaudhary Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://patch.msgid.link/4rikk44zew3s6577dugmx4jyblz7o5c57niuap6ct3td= 5yfm6w@gh7pcumg7qor --- kernel/time/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/time/time.c b/kernel/time/time.c index 0d83231..771cef8 100644 --- a/kernel/time/time.c +++ b/kernel/time/time.c @@ -207,7 +207,7 @@ SYSCALL_DEFINE2(settimeofday, struct __kernel_old_timev= al __user *, tv, get_user(new_ts.tv_nsec, &tv->tv_usec)) return -EFAULT; =20 - if (new_ts.tv_nsec > USEC_PER_SEC || new_ts.tv_nsec < 0) + if (new_ts.tv_nsec >=3D USEC_PER_SEC || new_ts.tv_nsec < 0) return -EINVAL; =20 new_ts.tv_nsec *=3D NSEC_PER_USEC;