[PATCH] select: time comparison fixes

I got all of these backwards.  We want to return

	min(input timeout, new timeout)

to userspace to prevent increasing the time-remaining value.

Thanks to Ernst Herzberg <earny@net4u.de> for reporting and diagnosing.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/fs/compat.c b/fs/compat.c
index a2ba78bdf7f71384de2491779e8f83627e6ca4b0..5333c7d7427f6feeee2d72678893cde41294a3f4 100644 (file)
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1757,7 +1757,7 @@ asmlinkage long compat_sys_select(int n, compat_ulong_t __user *inp,
                        goto sticky;
                rtv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
                rtv.tv_sec = timeout;
-               if (compat_timeval_compare(&rtv, &tv) < 0)
+               if (compat_timeval_compare(&rtv, &tv) >= 0)
                        rtv = tv;
                if (copy_to_user(tvp, &rtv, sizeof(rtv))) {
 sticky:
@@ -1834,7 +1834,7 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
                        rts.tv_sec++;
                        rts.tv_nsec -= NSEC_PER_SEC;
                }
-               if (compat_timespec_compare(&rts, &ts) < 0)
+               if (compat_timespec_compare(&rts, &ts) >= 0)
                        rts = ts;
                copy_to_user(tsp, &rts, sizeof(rts));
        }
@@ -1934,7 +1934,7 @@ asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
                rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
                                        1000;
                rts.tv_sec = timeout;
-               if (compat_timespec_compare(&rts, &ts) < 0)
+               if (compat_timespec_compare(&rts, &ts) >= 0)
                        rts = ts;
                if (copy_to_user(tsp, &rts, sizeof(rts))) {
 sticky:

diff --git a/fs/select.c b/fs/select.c
index 6ce68a9c8976e613ba271c627e6a571bc293cdb5..1815a57d225585122c22dd0a357dbdced59e1c40 100644 (file)
--- a/fs/select.c
+++ b/fs/select.c
@@ -404,7 +404,7 @@ asmlinkage long sys_select(int n, fd_set __user *inp, fd_set __user *outp,
                        goto sticky;
                rtv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
                rtv.tv_sec = timeout;
-               if (timeval_compare(&rtv, &tv) < 0)
+               if (timeval_compare(&rtv, &tv) >= 0)
                        rtv = tv;
                if (copy_to_user(tvp, &rtv, sizeof(rtv))) {
 sticky:
@@ -471,7 +471,7 @@ asmlinkage long sys_pselect7(int n, fd_set __user *inp, fd_set __user *outp,
                rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
                                                1000;
                rts.tv_sec = timeout;
-               if (timespec_compare(&rts, &ts) < 0)
+               if (timespec_compare(&rts, &ts) >= 0)
                        rts = ts;
                if (copy_to_user(tsp, &rts, sizeof(rts))) {
 sticky:
@@ -775,7 +775,7 @@ asmlinkage long sys_ppoll(struct pollfd __user *ufds, unsigned int nfds,
                rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
                                                1000;
                rts.tv_sec = timeout;
-               if (timespec_compare(&rts, &ts) < 0)
+               if (timespec_compare(&rts, &ts) >= 0)
                        rts = ts;
                if (copy_to_user(tsp, &rts, sizeof(rts))) {
                sticky: