Re: kern/58914: timerfd_settime(2) is missing itimespecfix

[Taylor R Campbell <riastradh%NetBSD.org@localhost>]

Can you please try the attached patch?

# HG changeset patch
# User Taylor R Campbell <riastradh%NetBSD.org@localhost>
# Date 1734506499 0
#      Wed Dec 18 07:21:39 2024 +0000
# Branch trunk
# Node ID e050d078726dabe394b8accea318c2caf71ef290
# Parent  fdd2a8b62ce7ef83fb5433dbfd053c271728d8a2
# EXP-Topic riastradh-pr58914-timerfdfix
timerfd_settime(2): Sanitize inputs like timer_settime(2).

PR kern/58914: timerfd_settime(2) is missing itimespecfix

diff -r fdd2a8b62ce7 -r e050d078726d sys/kern/sys_timerfd.c
--- a/sys/kern/sys_timerfd.c	Tue Dec 17 12:44:33 2024 +0000
+++ b/sys/kern/sys_timerfd.c	Wed Dec 18 07:21:39 2024 +0000
@@ -593,12 +593,16 @@ do_timerfd_settime(struct lwp *l, int fd
     const struct itimerspec *new_value, struct itimerspec *old_value,
     register_t *retval)
 {
+	struct itimerspec value = *new_value;
 	file_t *fp;
 	int error;
 
 	if (flags & ~(TFD_TIMER_ABSTIME | TFD_TIMER_CANCEL_ON_SET)) {
 		return EINVAL;
 	}
+	if ((error = itimespecfix(&value.it_value)) != 0 ||
+	    (error = itimespecfix(&value.it_interval)) != 0)
+		return error;
 
 	if ((fp = fd_getfile(fd)) == NULL) {
 		return EBADF;
@@ -618,7 +622,7 @@ do_timerfd_settime(struct lwp *l, int fd
 	if (old_value != NULL) {
 		*old_value = it->it_time;
 	}
-	it->it_time = *new_value;
+	it->it_time = value;
 
 	/*
 	 * If we've been passed a relative value, convert it to an