From ffdfdfb66b8b6b8ea7f2272144f8d7e04621db36 Mon Sep 17 00:00:00 2001 From: Tzafrir Cohen Date: Wed, 13 Jan 2016 12:19:04 +0200 Subject: [PATCH] xpp_usb: Fix potential corruption on clock rewind The xpp modules use time differences for various statistics. In one case xpp_usb creates a histogram of the time it took the system to send USB packets (URBs). The time difference is used (after adjustments) as an index to that array. However if the clock happens to go back at that exact point in time, we get to write to an arbitrary negative index in this array. Signed-off-by: Tzafrir Cohen --- drivers/dahdi/xpp/xpp_usb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/dahdi/xpp/xpp_usb.c b/drivers/dahdi/xpp/xpp_usb.c index a106211..b0a9903 100644 --- a/drivers/dahdi/xpp/xpp_usb.c +++ b/drivers/dahdi/xpp/xpp_usb.c @@ -890,6 +890,8 @@ static void xpp_send_callback(USB_PASS_CB(urb)) do_gettimeofday(&now); xusb->last_tx = xframe->tv_submitted; usec = usec_diff(&now, &xframe->tv_submitted); + if (usec < 0) + usec = 0; /* System clock jumped */ if (usec > xusb->max_tx_delay) xusb->max_tx_delay = usec; i = usec / USEC_BUCKET;