From 57ffd5b939df456b7e573d91d6b23bc01f36f353 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Tue, 29 Oct 2024 14:24:16 +1100
Subject: [PATCH] Linux: Boottime API: Refactor TimespecVol3::negate() to
 return a new object instead of modifying the original. It also normalizes its
 values, aligning with the behavior of the other addition and subtraction
 operators

---
 volatility3/framework/symbols/linux/__init__.py    | 14 +++++++++++---
 .../framework/symbols/linux/extensions/__init__.py | 10 ++--------
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py
index 8c28ca562..4123674ed 100644
--- a/volatility3/framework/symbols/linux/__init__.py
+++ b/volatility3/framework/symbols/linux/__init__.py
@@ -909,6 +909,7 @@ class TimespecVol3(object):
             tv_sec=self.tv_sec - timespec.tv_sec,
             tv_nsec=self.tv_nsec - timespec.tv_nsec,
         )
+
         result.normalize()
 
         return result
@@ -925,6 +926,13 @@ class TimespecVol3(object):
             self.tv_sec -= 1
 
     def negate(self):
-        """Negates the sign of both tv_sec and tv_nsec"""
-        self.tv_sec = -self.tv_sec
-        self.tv_nsec = -self.tv_nsec
+        """Returns a new TimespecVol3 object with the values of the current object negated"""
+
+        result = TimespecVol3(
+            tv_sec=-self.tv_sec,
+            tv_nsec=-self.tv_nsec,
+        )
+
+        result.normalize()
+
+        return result
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 2784aeda7..6fd55cb56 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -502,10 +502,7 @@ class task_struct(generic.GenericIntelProcess):
 
             boottime += timekeeper.total_sleep_time
 
-            boottime.negate()
-            boottime.normalize()
-
-            return boottime
+            return boottime.negate()
 
         elif vmlinux.has_symbol("wall_to_monotonic"):
             # kernels < 3.4 - Tested on Debian7 3.2.0-4 (3.2.57-3+deb7u2)
@@ -523,10 +520,7 @@ class task_struct(generic.GenericIntelProcess):
                     # kernels < 2.6.32 total_sleep_time is an unsigned long as seconds
                     boottime.tv_sec += total_sleep_time
 
-            boottime.negate()
-            boottime.normalize()
-
-            return boottime
+            return boottime.negate()
 
         raise exceptions.VolatilityException("Unsupported")