Re: [PATCH] ppdev: prevent overflow when setting port timeout

[Arnd Bergmann]

On Thu, Jul 16, 2026, at 03:39, Linmao Li wrote:
> PPSETTIME64 supplies the timeval fields as s64 values, but
> pp_set_timeout() narrows tv_usec to int and calculates tv_sec * HZ in a
> signed long. Large positive values can therefore be truncated or overflow
> and install an unintended timeout.
>
> Keep both fields as s64, reject a non-canonical microsecond value, and
> use timespec64_to_jiffies() to cap excessively large timeouts at
> MAX_JIFFY_OFFSET. This is a behavior change because both PPSETTIME
> ioctls could previously accept values with tv_usec >= USEC_PER_SEC.
> The validation follows the precedent set by sock_set_timeout().
>
> Fixes: 3b9ab374a1e6 ("ppdev: convert to y2038 safe")
> Signed-off-by: Linmao Li <lilinmao@xxxxxxxxxx>

Good catch!

> -	to_jiffies = usecs_to_jiffies(tv_usec);
> -	to_jiffies += tv_sec * HZ;
> +	ts.tv_sec = tv_sec;
> +	ts.tv_nsec = tv_usec * NSEC_PER_USEC;
> +	to_jiffies = timespec64_to_jiffies(&ts);
>  	if (to_jiffies <= 0)
>  		return -EINVAL;

This is a bit more expensive, but it's clearly not performance
critical and I agree that the added range checking is a
nice improvement here.

I also checked codesearch.debian.net to see if any callers
might rely on passing out-of-range arguments, but the only
caller I found (pyparallel) is guaranteed to pass a
normalized timeval.

Reviewed-by: Arnd Bergmann <arnd@xxxxxxxx>