[src/trunk]: src/sys/net bpf(4): Reject bogus timeout values before arithmeti...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/4c392799359e
branches:  trunk
changeset: 369845:4c392799359e
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Sat Sep 03 10:03:20 2022 +0000

description:
bpf(4): Reject bogus timeout values before arithmetic overflows.

Reported-by: syzbot+fbd86bdf579944b64a98%syzkaller.appspotmail.com@localhost
https://syzkaller.appspot.com/bug?id=60d46fd4863952897cbf67c6b1bcc8b20ec7bde6

XXX pullup-8
XXX pullup-9

diffstat:

 sys/net/bpf.c |  16 ++++++++++++----
 1 files changed, 12 insertions(+), 4 deletions(-)

diffs (44 lines):

diff -r 9ec38ec2250b -r 4c392799359e sys/net/bpf.c
--- a/sys/net/bpf.c     Sat Sep 03 09:41:24 2022 +0000
+++ b/sys/net/bpf.c     Sat Sep 03 10:03:20 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: bpf.c,v 1.246 2022/03/15 13:00:44 riastradh Exp $      */
+/*     $NetBSD: bpf.c,v 1.247 2022/09/03 10:03:20 riastradh Exp $      */
 
 /*
  * Copyright (c) 1990, 1991, 1993
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: bpf.c,v 1.246 2022/03/15 13:00:44 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: bpf.c,v 1.247 2022/09/03 10:03:20 riastradh Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_bpf.h"
@@ -1152,7 +1152,11 @@
                        struct timeval *tv = addr;
 
                        /* Compute number of ticks. */
-                       if (tv->tv_sec > INT_MAX/hz - 1) {
+                       if (tv->tv_sec < 0 ||
+                           tv->tv_usec < 0 || tv->tv_usec >= 1000000) {
+                               error = EINVAL;
+                               break;
+                       } else if (tv->tv_sec > INT_MAX/hz - 1) {
                                d->bd_rtout = INT_MAX;
                        } else {
                                d->bd_rtout = tv->tv_sec * hz
@@ -1186,7 +1190,11 @@
                        struct timeval50 *tv = addr;
 
                        /* Compute number of ticks. */
-                       if (tv->tv_sec > INT_MAX/hz - 1) {
+                       if (tv->tv_sec < 0 ||
+                           tv->tv_usec < 0 || tv->tv_usec >= 1000000) {
+                               error = EINVAL;
+                               break;
+                       } else if (tv->tv_sec > INT_MAX/hz - 1) {
                                d->bd_rtout = INT_MAX;
                        } else {
                                d->bd_rtout = tv->tv_sec * hz