[src/trunk]: src/sys/kern Validate usec ranges in do_sys_utimes()

[kamil <kamil%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/4c5e4d516c0a
branches:  trunk
changeset: 1003550:4c5e4d516c0a
user:      kamil <kamil%NetBSD.org@localhost>
date:      Fri Sep 20 13:29:31 2019 +0000

description:
Validate usec ranges in do_sys_utimes()

sys/kern/vfs_syscalls.c:3939:4, signed integer overflow: 503923632 * 1000 cannot be represented in type 'int'

Reported-by: syzbot+4cfc86ffd30e8678f68d%syzkaller.appspotmail.com@localhost

diffstat:

 sys/kern/vfs_syscalls.c |  16 ++++++++++++----
 1 files changed, 12 insertions(+), 4 deletions(-)

diffs (43 lines):

diff -r 9b0bcc8d1485 -r 4c5e4d516c0a sys/kern/vfs_syscalls.c
--- a/sys/kern/vfs_syscalls.c   Fri Sep 20 12:41:33 2019 +0000
+++ b/sys/kern/vfs_syscalls.c   Fri Sep 20 13:29:31 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: vfs_syscalls.c,v 1.534 2019/09/15 20:51:03 christos Exp $      */
+/*     $NetBSD: vfs_syscalls.c,v 1.535 2019/09/20 13:29:31 kamil Exp $ */
 
 /*-
  * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
@@ -70,7 +70,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: vfs_syscalls.c,v 1.534 2019/09/15 20:51:03 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vfs_syscalls.c,v 1.535 2019/09/20 13:29:31 kamil Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_fileassoc.h"
@@ -3929,14 +3929,22 @@
                if ((tptr[0].tv_usec == UTIME_NOW) || 
                    (tptr[0].tv_usec == UTIME_OMIT))
                        ts[0].tv_nsec = tptr[0].tv_usec;
-               else
+               else {
+                       if (tptr[0].tv_usec < 0 || tptr[0].tv_usec >= 1000000)
+                               return EINVAL;
+
                        TIMEVAL_TO_TIMESPEC(&tptr[0], &ts[0]);
+               }
 
                if ((tptr[1].tv_usec == UTIME_NOW) || 
                    (tptr[1].tv_usec == UTIME_OMIT))
                        ts[1].tv_nsec = tptr[1].tv_usec;
-               else
+               else {
+                       if (tptr[1].tv_usec < 0 || tptr[1].tv_usec >= 1000000)
+                               return EINVAL;
+
                        TIMEVAL_TO_TIMESPEC(&tptr[1], &ts[1]);
+               }
 
                tsptr = &ts[0]; 
        }