DF-5842 — select(2)/pselect(2)/ppoll(2) accept invalid timeouts unvalidated; long timers collapse

What

sys/kern/sys_generic.c copies the user timeout into the kernel and passes it straight into kern_kevent() with no range or normalization check:

• sys_select() :807-815 — timeval, no check
• sys_pselect() :842-849 — timespec, no check
• sys_ppoll() :1271-1278 — timespec, no check

(sys_poll()'s computed {timeout/1000, (timeout%1000)*1e6} is always valid, so only the timeout-pointer syscalls are affected.)

Inside kern_kevent() (sys/kern/kern_event.c:872-1000) the raw value is added to the current uptime and later converted by tstohz_high() (sys/kern/kern_clock.c:1227+) or, for ppoll (KEVENT_TIMEOUT_PRECISE), by ustimeout = atx.tv_sec * 1000000 + atx.tv_nsec / 1000 (kern_event.c:975) — both of which overflow/truncate for unnormalized huge sub-second fields, and both of which treat negative targets as "already expired".

Contrast: the nd == 0 / nfds == 0 paths of the very same syscalls go to dotimeout_only() → nanosleep1() → clock_nanosleep1(), which DOES reject tv_sec < 0 || tv_nsec < 0 || tv_nsec >= 1000000000 with EINVAL (sys/kern/kern_time.c:467).

Demonstrated (unprivileged, deterministic over 3 runs)

Impact: any long-intended poll/select/watchdog built on these syscalls can be made to return immediately or after an arbitrary wrong duration by an unprivileged caller; POSIX conformance violation. Same observable class as DF-5835 (kern_clock.c converters) but a distinct defect and fix location: missing validation at these syscall entries, plus overflow sites (kern_event.c:975 precise multiply; tvtohz_high huge-usec (int) cast) that only see garbage because the entries let it through.

Reproduce

build.sh   # cc -O -o /tmp/timeout_rig /tmp/timeout_rig.c; cc -O -o /tmp/t8 /tmp/t8.c
run.sh     # /tmp/timeout_rig && /tmp/t8 && /tmp/t8
           # expect the table above (total runtime ~8 s)

DF-5842 VERDICT — reproduced (timer-semantics corruption, unprivileged)

Bottom line

select(2), pselect(2) and ppoll(2) copy the user-supplied timeout into the kernel and hand it to kern_kevent() with no validation whatsoever (sys/kern/sys_generic.c:807-815, :842-849, :1271-1278). Negative and unnormalized (sub-second field ≥ 1e9/1e6) values flow into timespecadd/tstohz_high/precise_sleep, where they either mean "already expired" (immediate return with success) or overflow integer conversions and produce arbitrary wrong durations. Demonstrated live on the audit guest as unprivileged uid=1001, deterministic across 3 runs:

• pselect(fd, {tv_sec:-1}) → rc=0 in 19-87 µs (POSIX: EINVAL)
• select(fd, {tv_usec: 2^62}) → rc=0 in 38-73 µs — a ~146-year intended sleep collapses to immediate return (tick math (int)(sec*hz + howmany(4.6e15 usec, ustick)) truncates mod 2^32 to a non-positive tick count; tvtohz_high kern_clock.c:1196-1200)
• ppoll(fd, {tv_nsec: 2^62}) → rc=0 after 1.69-1.98 s (PRECISE path: ustimeout = atx.tv_sec*1000000 + atx.tv_nsec/1000 int-overflows, kern_event.c:975, systimer fires after the truncated value)
• select(0 fds, {tv_sec:-1}) → EINVAL: the nd==0 path of the same syscall routes through nanosleep1()→clock_nanosleep1() which validates (kern_time.c:467) — proving the inconsistency is the missing entry check, not the sleep machinery.

Controls ({2s} → 2.000 s, {0.5s} → 0.500 s) prove the rig measures real sleeps. Full logs: run.log, run.2.log (3 consecutive full runs + 2 T8 runs, all consistent).

Root cause (path:line)

1. sys_select sys_generic.c:807-811: copyin(uap->tv, &ktv) then TIMEVAL_TO_TIMESPEC — no tv_sec<0 / tv_usec<0 / tv_usec>=1000000 check.
2. sys_pselect sys_generic.c:842-846 and sys_ppoll sys_generic.c:1271-1275: copyin(uap->ts, &kts) — no tv_sec<0 / tv_nsec<0 / tv_nsec>=1000000000 check.
3. kern_kevent kern_event.c:872-875: timespecadd(tsp, &ats, tsp) on the raw value (negative target ⇒ in the past ⇒ EWOULDBLOCK treated as "no events" ⇒ immediate success).
4. kern_kevent wait loop kern_event.c:958-1000: PRECISE multiply overflows for unnormalized nsec; non-precise tstohz_high(&atx) (kern_clock.c:1227-1250) casts sec*hz + howmany(nsec, nstick) to int — huge nsec wraps to arbitrary/negative ticks (callout clamps to 1 tick ⇒ immediate wake, same endpoint as DF-5835 documented).

Why not a duplicate of DF-5835

DF-5835 (kern_clock.c) is the seconds-term overflow inside the four converters at the sec == INT_MAX/hz boundary; its fix (headroom guard in the converters) does not stop T1/T2b/T3/T7 (negative and unnormalized values) and does not cover kern_event.c:975. This finding is the missing syscall-entry validation in sys_generic.c; the fix mirrors clock_nanosleep1()'s check (kern_time.c:467) — FreeBSD does exactly this in kern/select/poll paths. Complementary file, complementary fix.

Impact

Unprivileged local timer-semantics corruption: an application's arbitrarily long select/poll timeout can silently become immediate return or a random short duration (breaking long-poll loops, watchdogs, retry throttles — they spin); POSIX conformance violation. No memory corruption, no info leak — severity Low, impact class dos (same class DF-5835 was filed under).

Fix validation

Not rebuilt: Low-severity semantics finding, non-memory-corruption — fix.diff is the entry-validation patch (3 hunks, mirrors clock_nanosleep1's exact predicate). With it, T1/T2/T2b/T3/T7/T8 all become clean EINVAL and the controls are unchanged. fix_status: not_tested (no patched-kernel run performed for this Low finding).

Attempts: 2 (initial rig had an unbounded T7 that wedged the first ssh session for its full 4000 s intended sleep — itself confirming that huge normalized positive values are honored; rig was bounded with alarm(30) and T7 re-scoped). Guest stayed up throughout; no panic; no dirty state.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.