[Bug time/27662] New: adjtimex/clock_adjtime: y2038 regression causes segfault or wrong return value

[Bug time/27662] New: adjtimex/clock_adjtime: y2038 regression causes segfault or wrong return value

[adrian.ratiu at collabora dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27662

            Bug ID: 27662
           Summary: adjtimex/clock_adjtime: y2038 regression causes
                    segfault or wrong return value
           Product: glibc
           Version: 2.32
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: time
          Assignee: unassigned at sourceware dot org
          Reporter: adrian.ratiu at collabora dot com
  Target Milestone: ---

This is a continuation of BZ #26833 for adjtimex/clock_adjtime.

Example of segfault from a 32bit armv7 system:

$ cat timex.c

#include <errno.h>
#include <string.h>
#include <sys/timex.h>

int main(void) {
  int ret;
  /* Test with nullptr buffer. Should fail with EFAULT. */
  ret = adjtimex(NULL);
  if (ret == -EFAULT)
    return 0;
  return 1;
}

$ armv7a-cros-linux-gnueabihf-gcc -o main timex.c -static -g
$ qemu-arm main
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Segmentation fault.

I believe the following commits need fixing to correctly handle the NULL case:

8f8a6cae48 y2038: linux: Provide ___adjtimex64 implementation
63ff4a6d17 y2038: linux: Provide __clock_adjtime64 implementation

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug time/27662] adjtimex/clock_adjtime: y2038 regression causes segfault

[adrian.ratiu at collabora dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27662

Adrian Ratiu <adrian.ratiu at collabora dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|adjtimex/clock_adjtime:     |adjtimex/clock_adjtime:
                   |y2038 regression causes     |y2038 regression causes
                   |segfault or wrong return    |segfault
                   |value                       |

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug time/27662] adjtimex/clock_adjtime: y2038 regression causes segfault

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27662

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |NOTABUG
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #1 from Andreas Schwab <schwab@linux-m68k.org> ---
NULL is not a valid argument for adjtimex.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug time/27662] adjtimex/clock_adjtime: y2038 regression causes segfault

[adrian.ratiu at collabora dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27662

Adrian Ratiu <adrian.ratiu at collabora dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|NOTABUG                     |---
             Status|RESOLVED                    |UNCONFIRMED

--- Comment #2 from Adrian Ratiu <adrian.ratiu at collabora dot com> ---
(In reply to Andreas Schwab from comment #1)
> NULL is not a valid argument for adjtimex.

Yes, but the call shouldn't segfault nevertheless and just return -1 and set
errno to -EFAULT when the argument is NULL, right? This is definitely a
regression (only happens on 32bit armv7 for me).

Also I have a small error in my example code (I tested retcode for EFAULT),
here is the fixed version:

#include <errno.h>
#include <string.h>
#include <sys/timex.h>

int main(void) {
  int ret;
  /* Test with nullptr buffer. Should fail with EFAULT. */
  ret = adjtimex(NULL);
  if (ret == -1 && errno == EFAULT)
    return 0;
  return 1;
}

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug time/27662] adjtimex/clock_adjtime: y2038 regression causes segfault on 32bit arm

[adrian.ratiu at collabora dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27662

Adrian Ratiu <adrian.ratiu at collabora dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|adjtimex/clock_adjtime:     |adjtimex/clock_adjtime:
                   |y2038 regression causes     |y2038 regression causes
                   |segfault                    |segfault on 32bit arm

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug time/27662] adjtimex/clock_adjtime: y2038 regression causes segfault on 32bit arm

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27662

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |NOTABUG

--- Comment #3 from Andreas Schwab <schwab@linux-m68k.org> ---
It is undefined behaviour, anything can happen.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug time/27662] adjtimex/clock_adjtime: y2038 regression causes segfault on 32bit arm

[nixiaoming at huawei dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27662

nixiaoming <nixiaoming at huawei dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |nixiaoming at huawei dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug time/27662] adjtimex/clock_adjtime: y2038 regression causes segfault on 32bit arm

[nixiaoming at huawei dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27662

--- Comment #4 from nixiaoming <nixiaoming at huawei dot com> ---
Would it be better to add __nonnull to the function declaration?

Like this:

-extern int __adjtimex (struct timex *__ntx);
+extern int __adjtimex (struct timex *__ntx) __nonnull ((1));

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug time/27662] adjtimex/clock_adjtime: y2038 regression causes segfault on 32bit arm

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27662

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com

--- Comment #5 from Florian Weimer <fweimer at redhat dot com> ---
I think this would make sense, but the public header would have to be updated,
too.

-- 
You are receiving this mail because:
You are on the CC list for the bug.