2.6.24.3-rc1

 kernel

diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index f994bb8..2429893 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -325,6 +325,24 @@ unsigned long ktime_divns(const ktime_t kt, s64 div)
 }
 #endif /* BITS_PER_LONG >= 64 */
 
+/*
+ * Add two ktime values and do a safety check for overflow:
+ */
+
+ktime_t ktime_add_safe(const ktime_t lhs, const ktime_t rhs)
+{
+   ktime_t res = ktime_add(lhs, rhs);
+
+   /*
+    * We use KTIME_SEC_MAX here, the maximum timeout which we can
+    * return to user space in a timespec:
+    */
+   if (res.tv64 < 0 || res.tv64 < lhs.tv64 || res.tv64 < rhs.tv64)
+      res = ktime_set(KTIME_SEC_MAX, 0);
+
+   return res;
+}
+
 /* High resolution timer related functions */
 #ifdef CONFIG_HIGH_RES_TIMERS
 
@@ -409,6 +427,8 @@ static int hrtimer_reprogram(struct hrtimer *timer,
    ktime_t expires = ktime_sub(timer->expires, base->offset);
    int res;
 
+   WARN_ON_ONCE(timer->expires.tv64 < 0);
+
    /*
     * When the callback is running, we do not reprogram the clock event
     * device. The timer callback is either running on a different CPU or
@@ -419,6 +439,15 @@ static int hrtimer_reprogram(struct hrtimer *timer,
    if (hrtimer_callback_running(timer))
       return 0;
 
+   /*
+    * CLOCK_REALTIME timer might be requested with an absolute
+    * expiry time which is less than base->offset. Nothing wrong
+    * about that, just avoid to call into the tick code, which
+    * has now objections against negative expiry values.
+    */
+   if (expires.tv64 < 0)
+      return -ETIME;
+
    if (expires.tv64 >= expires_next->tv64)
       return 0;
 
@@ -682,13 +711,7 @@ hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval)
        */
       orun++;
    }
-   timer->expires = ktime_add(timer->expires, interval);
-   /*
-    * Make sure, that the result did not wrap with a very large
-    * interval.
-    */
-   if (timer->expires.tv64 < 0)
-      timer->expires = ktime_set(KTIME_SEC_MAX, 0);
+   timer->expires = ktime_add_safe(timer->expires, interval);
 
    return orun;
 }
@@ -839,7 +862,7 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
    new_base = switch_hrtimer_base(timer, base);
 
    if (mode == HRTIMER_MODE_REL) {
-      tim = ktime_add(tim, new_base->get_time());
+      tim = ktime_add_safe(tim, new_base->get_time());
       /*
        * CONFIG_TIME_LOW_RES is a temporary way for architectures
        * to signal that they simply return xtime in
@@ -848,16 +871,8 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
        * timeouts. This will go away with the GTOD framework.
        */
 #ifdef CONFIG_TIME_LOW_RES
-      tim = ktime_add(tim, base->resolution);
+      tim = ktime_add_safe(tim, base->resolution);
 #endif
-      /*
-       * Careful here: User space might have asked for a
-       * very long sleep, so the add above might result in a
-       * negative number, which enqueues the timer in front
-       * of the queue.
-       */
-      if (tim.tv64 < 0)
-         tim.tv64 = KTIME_MAX;
    }
    timer->expires = tim;
 
@@ -1291,11 +1306,26 @@ static int __sched do_nanosleep(struct hrtimer_sleeper *t, enum hrtimer_mode mod
    return t->task == NULL;
 }
 
+static int update_rmtp(struct hrtimer *timer, struct timespec __user *rmtp)
+{
+   struct timespec rmt;
+   ktime_t rem;
+
+   rem = ktime_sub(timer->expires, timer->base->get_time());
+   if (rem.tv64 <= 0)
+      return 0;
+   rmt = ktime_to_timespec(rem);
+
+   if (copy_to_user(rmtp, &rmt, sizeof(*rmtp)))
+      return -EFAULT;
+
+   return 1;
+}
+
 long __sched hrtimer_nanosleep_restart(struct restart_block *restart)
 {
    struct hrtimer_sleeper t;
-   struct timespec *rmtp;
-   ktime_t time;
+   struct timespec __user  *rmtp;
 
    restart->fn = do_no_restart_syscall;
 
@@ -1305,12 +1335,11 @@ long __sched hrtimer_nanosleep_restart(struct restart_block *restart)
    if (do_nanosleep(&t, HRTIMER_MODE_ABS))
       return 0;
 
-   rmtp = (struct timespec *)restart->arg1;
+   rmtp = (struct timespec __user *)restart->arg1;
    if (rmtp) {
-      time = ktime_sub(t.timer.expires, t.timer.base->get_time());
-      if (time.tv64 <= 0)
-         return 0;
-      *rmtp = ktime_to_timespec(time);
+      int ret = update_rmtp(&t.timer, rmtp);
+      if (ret <= 0)
+         return ret;
    }
 
    restart->fn = hrtimer_nanosleep_restart;
@@ -1319,12 +1348,11 @@ long __sched hrtimer_nanosleep_restart(struct restart_block *restart)
    return -ERESTART_RESTARTBLOCK;
 }
 
-long hrtimer_nanosleep(struct timespec *rqtp, struct timespec *rmtp,
+long hrtimer_nanosleep(struct timespec *rqtp, struct timespec __user *rmtp,
              const enum hrtimer_mode mode, const clockid_t clockid)
 {
    struct restart_block *restart;
    struct hrtimer_sleeper t;
-   ktime_t rem;
 
    hrtimer_init(&t.timer, clockid, mode);
    t.timer.expires = timespec_to_ktime(*rqtp);
@@ -1336,10 +1364,9 @@ long hrtimer_nanosleep(struct timespec *rqtp, struct timespec *rmtp,
       return -ERESTARTNOHAND;
 
    if (rmtp) {
-      rem = ktime_sub(t.timer.expires, t.timer.base->get_time());
-      if (rem.tv64 <= 0)
-         return 0;
-      *rmtp = ktime_to_timespec(rem);
+      int ret = update_rmtp(&t.timer, rmtp);
+      if (ret <= 0)
+         return ret;
    }
 
    restart = ¤t_thread_info()->restart_block;
@@ -1355,8 +1382,7 @@ long hrtimer_nanosleep(struct timespec *rqtp, struct timespec *rmtp,
 asmlinkage long
 sys_nanosleep(struct timespec __user *rqtp, struct timespec __user *rmtp)
 {
-   struct timespec tu, rmt;
-   int ret;
+   struct timespec tu;
 
    if (copy_from_user(&tu, rqtp, sizeof(tu)))
       return -EFAULT;
@@ -1364,15 +1390,7 @@ sys_nanosleep(struct timespec __user *rqtp, struct timespec __user *rmtp)
    if (!timespec_valid(&tu))
       return -EINVAL;
 
-   ret = hrtimer_nanosleep(&tu, rmtp ? &rmt : NULL, HRTIMER_MODE_REL,
-            CLOCK_MONOTONIC);
-
-   if (ret && rmtp) {
-      if (copy_to_user(rmtp, &rmt, sizeof(*rmtp)))
-         return -EFAULT;
-   }
-
-   return ret;
+   return hrtimer_nanosleep(&tu, rmtp, HRTIMER_MODE_REL, CLOCK_MONOTONIC);
 }
 
 /*