#ifndef TAIA_H
#define TAIA_H

#include <stdint.h>
#include <stdbool.h>
#include <stdio.h>
#include <sys/time.h>

#include "rnd.h"

struct tai {
	uint64_t x;
};

struct taia {
	struct tai sec;
	uint32_t nano;
	uint32_t atto;
};

static inline void tai_pack(unsigned char *s, struct tai *t)
{
	uint64_t x;

	x = t->x;

	s[7] = x & 255; x >>= 8;
	s[6] = x & 255; x >>= 8;
	s[5] = x & 255; x >>= 8;
	s[4] = x & 255; x >>= 8;
	s[3] = x & 255; x >>= 8;
	s[2] = x & 255; x >>= 8;
	s[1] = x & 255; x >>= 8;
	s[0] = x;
}

static inline void tai_unpack(unsigned char *s, struct tai *t)
{
	uint64_t x;

	x = (unsigned char) s[0];
	x <<= 8; x += (unsigned char) s[1];
	x <<= 8; x += (unsigned char) s[2];
	x <<= 8; x += (unsigned char) s[3];
	x <<= 8; x += (unsigned char) s[4];
	x <<= 8; x += (unsigned char) s[5];
	x <<= 8; x += (unsigned char) s[6];
	x <<= 8; x += (unsigned char) s[7];

	t->x = x;
}

static inline void taia_pack(unsigned char *s, struct taia *t)
{
	unsigned long x;

	tai_pack(s, &t->sec);

	s += 8;

	x = t->atto;

	s[7] = x & 255; x >>= 8;
	s[6] = x & 255; x >>= 8;
	s[5] = x & 255; x >>= 8;
	s[4] = x;

	x = t->nano;

	s[3] = x & 255; x >>= 8;
	s[2] = x & 255; x >>= 8;
	s[1] = x & 255; x >>= 8;
	s[0] = x;
} 

static inline void taia_unpack(unsigned char *s, struct taia *t)
{
	unsigned long x;

	tai_unpack(s, &t->sec);

	s += 8;

	x = (unsigned char) s[4];
	x <<= 8; x += (unsigned char) s[5];
	x <<= 8; x += (unsigned char) s[6];
	x <<= 8; x += (unsigned char) s[7];

	t->atto = x;

	x = (unsigned char) s[0];
	x <<= 8; x += (unsigned char) s[1];
	x <<= 8; x += (unsigned char) s[2];
	x <<= 8; x += (unsigned char) s[3];

	t->nano = x;
}

#define tai_unix(t, u) \
		((void) ((t)->x = 4611686018427387914ULL + \
				  (uint64_t) (u)))

static inline void taia_now(struct taia *t)
{
	struct timeval now;

	gettimeofday(&now, NULL);

	tai_unix(&t->sec, now.tv_sec);
	t->nano = 1000 * now.tv_usec + 500;
	/* We don't really have it, but bring some noise in. */
	t->atto = secrand();
}

static inline void taia_sub(struct taia *res, const struct taia *u,
			    const struct taia *v)
{
	unsigned long unano = u->nano;
	unsigned long uatto = u->atto;

	res->sec.x = u->sec.x - v->sec.x;
	res->nano = unano - v->nano;
	res->atto = uatto - v->atto;

	if (res->atto > uatto) {
		res->atto += 1000000000UL;
		--res->nano;
	}

	if (res->nano > unano) {
		res->nano += 1000000000UL;
		--res->sec.x;
	}
}

static inline void taia_add(struct taia *res, const struct taia *u,
			    const struct taia *v)
{
	res->sec.x = u->sec.x + v->sec.x;
	res->nano = u->nano + v->nano;
	res->atto = u->atto + v->atto;

	if (res->atto > 999999999UL) {
		res->atto -= 1000000000UL;
		++res->nano;
	}

	if (res->nano > 999999999UL) {
		res->nano -= 1000000000UL;
		++res->sec.x;
	}
}

static inline int taia_less(const struct taia *t, const struct taia *u)
{
	if (t->sec.x < u->sec.x)
		return 1;
	if (t->sec.x > u->sec.x)
		return 0;
	if (t->nano < u->nano)
		return 1;
	if (t->nano > u->nano)
		return 0;
	return t->atto < u->atto;
}

extern bool taia_looks_good(struct taia *arr_taia, struct taia *pkt_taia);

#endif /* TAIA_H */
ion value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Jiri Slaby &lt;jslaby@suse.cz&gt;</td><td class='right'>2016-10-21 14:13:24 +0200</td></tr>
<tr><th>committer</th><td>David S. Miller &lt;davem@davemloft.net&gt;</td><td class='right'>2016-10-23 17:43:15 -0400</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/?id=a4b8e71b05c27bae6bad3bdecddbc6b68a3ad8cf'>a4b8e71b05c27bae6bad3bdecddbc6b68a3ad8cf</a> (<a href='/cgit.cgi/linux/net-next.git/patch/?id=a4b8e71b05c27bae6bad3bdecddbc6b68a3ad8cf'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/tree/?id=a4b8e71b05c27bae6bad3bdecddbc6b68a3ad8cf'>fc68709b76295d038b512403a430522dcdb48f02</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/?id=235bde1ed3f0fff0f68f367ec8807b89ea151258'>235bde1ed3f0fff0f68f367ec8807b89ea151258</a> (<a href='/cgit.cgi/linux/net-next.git/diff/?id=a4b8e71b05c27bae6bad3bdecddbc6b68a3ad8cf&amp;id2=235bde1ed3f0fff0f68f367ec8807b89ea151258'>diff</a>)</td></tr></table>
<div class='commit-subject'>net: sctp, forbid negative length</div><div class='commit-msg'>Most of getsockopt handlers in net/sctp/socket.c check len against
sizeof some structure like:
        if (len &lt; sizeof(int))
                return -EINVAL;

On the first look, the check seems to be correct. But since len is int
and sizeof returns size_t, int gets promoted to unsigned size_t too. So
the test returns false for negative lengths. Yes, (-1 &lt; sizeof(long)) is
false.

Fix this in sctp by explicitly checking len &lt; 0 before any getsockopt
handler is called.

Note that sctp_getsockopt_events already handled the negative case.
Since we added the &lt; 0 check elsewhere, this one can be removed.

If not checked, this is the result:
UBSAN: Undefined behaviour in ../mm/page_alloc.c:2722:19
shift exponent 52 is too large for 32-bit type 'int'
CPU: 1 PID: 24535 Comm: syz-executor Not tainted 4.8.1-0-syzkaller #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.1-0-gb3ef39f-prebuilt.qemu-project.org 04/01/2014
 0000000000000000 ffff88006d99f2a8 ffffffffb2f7bdea 0000000041b58ab3
 ffffffffb4363c14 ffffffffb2f7bcde ffff88006d99f2d0 ffff88006d99f270
 0000000000000000 0000000000000000 0000000000000034 ffffffffb5096422
Call Trace:
 [&lt;ffffffffb3051498&gt;] ? __ubsan_handle_shift_out_of_bounds+0x29c/0x300
...
 [&lt;ffffffffb273f0e4&gt;] ? kmalloc_order+0x24/0x90
 [&lt;ffffffffb27416a4&gt;] ? kmalloc_order_trace+0x24/0x220
 [&lt;ffffffffb2819a30&gt;] ? __kmalloc+0x330/0x540
 [&lt;ffffffffc18c25f4&gt;] ? sctp_getsockopt_local_addrs+0x174/0xca0 [sctp]
 [&lt;ffffffffc18d2bcd&gt;] ? sctp_getsockopt+0x10d/0x1b0 [sctp]
 [&lt;ffffffffb37c1219&gt;] ? sock_common_getsockopt+0xb9/0x150
 [&lt;ffffffffb37be2f5&gt;] ? SyS_getsockopt+0x1a5/0x270

Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;
Cc: Vlad Yasevich &lt;vyasevich@gmail.com&gt;
Cc: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Cc: "David S. Miller" &lt;davem@davemloft.net&gt;
Cc: linux-sctp@vger.kernel.org
Cc: netdev@vger.kernel.org
Acked-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</div><div class='diffstat-header'><a href='/cgit.cgi/linux/net-next.git/diff/?id=a4b8e71b05c27bae6bad3bdecddbc6b68a3ad8cf'>Diffstat</a></div><table summary='diffstat' class='diffstat'>