Skip to contentSkip to conversation

"wrong timeout value" in sk_wait_data()

PATCH In review Vasily Averin 3 participants 4 messages May 24, 2007

Subsystems (3)
Networking Network drivers Sockets
lore
Share & tools
lore

Vasily Averin

author
#0 lore raw

PATCH 1/1 "wrong timeout value" in sk_wait_data()

sys_setsockopt() do not check properly timeout values for SO_RCVTIMEO/SO_SNDTIMEO, for example it's possible to set negative timeout values. POSIX do not defines behaviour for sys_setsockopt in case negative timeouts, but requires that setsockopt() shall fail with -EDOM if the send and receive timeout values are too big to fit into the timeout fields in the socket structure.
In current implementation negative timeout can lead to error messages like "schedule_timeout: wrong timeout value".

Proposed patch:
- checks tv_usec and returns -EDOM if it is wrong
- do not allows to set negative timeout values (sets 0 instead) and outputs ratelimited information message about such attempts.

Signed-off-by Vasily Averin <[email protected]>
net/core/sock.c +0 -0
index 22183c2..27d7a46 100644
@@ -206,7 +206,19 @@ static int sock_set_timeout(long *timeo_p, char __user

*optval, int optlen)
return -EINVAL;
if (copy_from_user(&tv, optval, sizeof(tv)))
return -EFAULT;
-
+ if (tv.tv_usec < 0 || tv.tv_usec >= 1000000)
+ return -EDOM;
+
+ if (tv.tv_sec < 0) {
+ static int warned = 0;
+ *timeo_p = 0;
+ if (warned < 10 && net_ratelimit())
+ warned++;
+ printk(KERN_INFO "sock_set_timeout: `%s' (pid %d) "
+ "tries to set negative timeout\n",
+ current->comm, current->pid);
+ return 0;
+ }
*timeo_p = MAX_SCHEDULE_TIMEOUT;
if (tv.tv_sec == 0 && tv.tv_usec == 0)
return 0;

#1 lore raw
Quoted 21 lines · Vasily Averin

sys_setsockopt() do not check properly timeout values for SO_RCVTIMEO/SO_SNDTIMEO, for example it's possible to set negative timeout values. POSIX do not defines behaviour for sys_setsockopt in case negative timeouts, but requires that setsockopt() shall fail with -EDOM if the send and receive timeout values are too big to fit into the timeout fields in the socket structure.
In current implementation negative timeout can lead to error messages like "schedule_timeout: wrong timeout value".

Proposed patch:
- checks tv_usec and returns -EDOM if it is wrong
- do not allows to set negative timeout values (sets 0 instead) and outputs ratelimited information message about such attempts.

Signed-off-by Vasily Averin <[email protected]>
net/core/sock.c +0 -0
index 22183c2..27d7a46 100644

net/core/sock.c static int sock_set_timeout(long *timeo_p, char __user · line 211

Quoted 7 lines
net/core/sock.c +2 -1
@@ -206,7 +206,19 @@ static int sock_set_timeout(long *timeo_p, char __user
 *optval, int optlen)
 		return -EINVAL;
 	if (copy_from_user(&tv, optval, sizeof(tv)))
 		return -EFAULT;
-
+	if (tv.tv_usec < 0 || tv.tv_usec >= 1000000)
+		return -EDOM;

Please use USEC_PER_SEC instead of 1000000

Quoted 15 lines
net/core/sock.c +11 -0
+
+	if (tv.tv_sec < 0) {
+		static int warned = 0;
+		*timeo_p = 0;
+		if (warned < 10 && net_ratelimit())
+			warned++;
+			printk(KERN_INFO "sock_set_timeout: `%s' (pid %d) "
+			       "tries to set negative timeout\n",
+			        current->comm, current->pid);
+		return 0;
+	}
 	*timeo_p = MAX_SCHEDULE_TIMEOUT;
 	if (tv.tv_sec == 0 && tv.tv_usec == 0)

return 0;

author
#2 lore raw

PATCH 1/1 "wrong timeout value" in sk_wait_data() v2

sys_setsockopt() do not check properly timeout values for SO_RCVTIMEO/SO_SNDTIMEO, for example it's possible to set negative timeout values. POSIX do not defines behaviour for sys_setsockopt in case negative timeouts, but requires that setsockopt() shall fail with -EDOM if the send and receive timeout values are too big to fit into the timeout fields in the socket structure.
In current implementation negative timeout can lead to error messages like "schedule_timeout: wrong timeout value".

Proposed patch:
- checks tv_usec and returns -EDOM if it is wrong
- do not allows to set negative timeout values (sets 0 instead) and outputs ratelimited information message about such attempts.

Signed-off-by Vasily Averin <[email protected]>
net/core/sock.c +0 -0
index 22183c2..7e51d3a 100644
@@ -206,7 +206,19 @@ static int sock_set_timeout(long *timeo_p, char __user

*optval, int optlen)
return -EINVAL;
if (copy_from_user(&tv, optval, sizeof(tv)))
return -EFAULT;
-
+ if (tv.tv_usec < 0 || tv.tv_usec >= USEC_PER_SEC)
+ return -EDOM;
+
+ if (tv.tv_sec < 0) {
+ static int warned = 0;
+ *timeo_p = 0;
+ if (warned < 10 && net_ratelimit())
+ warned++;
+ printk(KERN_INFO "sock_set_timeout: `%s' (pid %d) "
+ "tries to set negative timeout\n",
+ current->comm, current->pid);
+ return 0;
+ }
*timeo_p = MAX_SCHEDULE_TIMEOUT;
if (tv.tv_sec == 0 && tv.tv_usec == 0)
return 0;

maintainer
#3 lore raw

Re: [PATCH netdev] "wrong timeout value" in sk_wait_data() v2

From: Vasily Averin <[email protected]>
Date: Thu, 24 May 2007 09:23:14 +0400

Quoted 9 lines

sys_setsockopt() do not check properly timeout values for SO_RCVTIMEO/SO_SNDTIMEO, for example it's possible to set negative timeout values. POSIX do not defines behaviour for sys_setsockopt in case negative timeouts, but requires that setsockopt() shall fail with -EDOM if the send and receive timeout values are too big to fit into the timeout fields in the socket structure.
In current implementation negative timeout can lead to error messages like "schedule_timeout: wrong timeout value".

Quoted 6 lines

Proposed patch:
- checks tv_usec and returns -EDOM if it is wrong
- do not allows to set negative timeout values (sets 0 instead) and outputs ratelimited information message about such attempts.

Signed-off-by Vasily Averin <[email protected]>

Thank you for this bug fix, patch applied.