Patch "ntp: Remove invalid cast in time offset math" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ntp: Remove invalid cast in time offset math

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ntp-remove-invalid-cast-in-time-offset-math.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 48de567858d5dc7108ccecf728b033cf598093e5
Author: Marcelo Dalmas <marcelo.dalmas@xxxxxx>
Date:   Mon Nov 25 12:16:09 2024 +0000

    ntp: Remove invalid cast in time offset math
    
    [ Upstream commit f5807b0606da7ac7c1b74a386b22134ec7702d05 ]
    
    Due to an unsigned cast, adjtimex() returns the wrong offest when using
    ADJ_MICRO and the offset is negative. In this case a small negative offset
    returns approximately 4.29 seconds (~ 2^32/1000 milliseconds) due to the
    unsigned cast of the negative offset.
    
    This cast was added when the kernel internal struct timex was changed to
    use type long long for the time offset value to address the problem of a
    64bit/32bit division on 32bit systems.
    
    The correct cast would have been (s32), which is correct as time_offset can
    only be in the range of [INT_MIN..INT_MAX] because the shift constant used
    for calculating it is 32. But that's non-obvious.
    
    Remove the cast and use div_s64() to cure the issue.
    
    [ tglx: Fix white space damage, use div_s64() and amend the change log ]
    
    Fixes: ead25417f82e ("timex: use __kernel_timex internally")
    Signed-off-by: Marcelo Dalmas <marcelo.dalmas@xxxxxx>
    Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
    Cc: stable@xxxxxxxxxxxxxxx
    Link: https://lore.kernel.org/all/SJ0P101MB03687BF7D5A10FD3C49C51E5F42E2@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 6d87f9889b039..d1b7a3909de1d 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -791,7 +791,7 @@ int __do_adjtimex(struct __kernel_timex *txc, const struct timespec64 *ts,
 		txc->offset = shift_right(time_offset * NTP_INTERVAL_FREQ,
 				  NTP_SCALE_SHIFT);
 		if (!(ntpdata->time_status & STA_NANO))
-			txc->offset = (u32)txc->offset / NSEC_PER_USEC;
+			txc->offset = div_s64(txc->offset, NSEC_PER_USEC);
 	}
 
 	result = ntpdata->time_state;