diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2026-05-23 10:03:58 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2026-05-23 10:03:58 +0200 |
| commit | 37f32d5ab83968d63cfba6092ecaae3e582db964 (patch) | |
| tree | 89302eb3515325d10aa669e592c3d1fe0ca29c95 /fs/select.c | |
| parent | e23844b2ddbdd004285f14bdc672b4d854ad4c4e (diff) | |
| parent | 9029496abfae3c208336855ae6f3e1f5f881ef76 (diff) | |
Merge tag 'kvm-s390-master-7.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD
KVM: s390: some vSIE and UCONTROL fixes
Fix some memory issues and some hangs in vSIE.
Diffstat (limited to 'fs/select.c')
| -rw-r--r-- | fs/select.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/fs/select.c b/fs/select.c index 75978b18f48f..bf71c9838dfe 100644 --- a/fs/select.c +++ b/fs/select.c @@ -708,6 +708,17 @@ static int kern_select(int n, fd_set __user *inp, fd_set __user *outp, if (copy_from_user(&tv, tvp, sizeof(tv))) return -EFAULT; + /* + * Reject negative components before normalisation. The seconds + * sum below is performed in signed long and a crafted negative + * timeval can wrap to a positive value that passes + * timespec64_valid() and turns into an effectively-infinite + * deadline via timespec64_add_safe()'s saturation, instead of + * the -EINVAL POSIX requires for negative timeouts. + */ + if (tv.tv_sec < 0 || tv.tv_usec < 0) + return -EINVAL; + to = &end_time; if (poll_select_set_timeout(to, tv.tv_sec + (tv.tv_usec / USEC_PER_SEC), |