brain-hackers_pepepper-mirror/linux-brain
1
0
Fork 0
mirror of https://github.com/brain-hackers/linux-brain.git synced 2024-06-09 23:36:23 +09:00
Code Issues Projects Releases Wiki Activity

hrtimer: check relative timeouts for overflow

Browse Source 
Various user space callers ask for relative timeouts. While we fixed
that overflow issue in hrtimer_start(), the sites which convert
relative user space values to absolute timeouts themself were uncovered.

Instead of putting overflow checks into each place add a function
which does the sanity checking and convert all affected callers to use
it.

Thanks to Frans Pop, who reported the problem and tested the fixes.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@elte.hu>
Tested-by: Frans Pop <elendil@planet.nl>
This commit is contained in:
Thomas Gleixner 2008-02-13 09:20:43 +01:00
parent e760e716d4
commit 5a7780e725
5 changed files with 29 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/linux/ktime.h
View File

@ -310,6 +310,8 @@ static inline ktime_t ktime_sub_us(const ktime_t kt, const u64 usec)
return ktime_sub_ns(kt, usec * 1000);
}
extern ktime_t ktime_add_safe(const ktime_t lhs, const ktime_t rhs);
/*
* The resolution of the clocks. The resolution value is returned in
* the clock_getres() system call to give application programmers an

2
kernel/futex.c
View File

@ -2116,7 +2116,7 @@ asmlinkage long sys_futex(u32 __user *uaddr, int op, u32 val,
t = timespec_to_ktime(ts);
if (cmd == FUTEX_WAIT)
t = ktime_add(ktime_get(), t);
t = ktime_add_safe(ktime_get(), t);
tp = &t;
}
/*

2
kernel/futex_compat.c
View File

@ -176,7 +176,7 @@ asmlinkage long compat_sys_futex(u32 __user *uaddr, int op, u32 val,
t = timespec_to_ktime(ts);
if (cmd == FUTEX_WAIT)
t = ktime_add(ktime_get(), t);
t = ktime_add_safe(ktime_get(), t);
tp = &t;
}
if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE)

37
kernel/hrtimer.c
View File

@ -325,6 +325,23 @@ u64 ktime_divns(const ktime_t kt, s64 div)
}
#endif /* BITS_PER_LONG >= 64 */
/*
* Add two ktime values and do a safety check for overflow:
*/
ktime_t ktime_add_safe(const ktime_t lhs, const ktime_t rhs)
{
ktime_t res = ktime_add(lhs, rhs);
/*
* We use KTIME_SEC_MAX here, the maximum timeout which we can
* return to user space in a timespec:
*/
if (res.tv64 < 0 || res.tv64 < lhs.tv64 || res.tv64 < rhs.tv64)
res = ktime_set(KTIME_SEC_MAX, 0);
return res;
}
/*
* Check, whether the timer is on the callback pending list
*/
@ -682,13 +699,7 @@ u64 hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval)
*/
orun++;
}
timer->expires = ktime_add(timer->expires, interval);
/*
* Make sure, that the result did not wrap with a very large
* interval.
*/
if (timer->expires.tv64 < 0)
timer->expires = ktime_set(KTIME_SEC_MAX, 0);
timer->expires = ktime_add_safe(timer->expires, interval);
return orun;
}
@ -839,7 +850,7 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
new_base = switch_hrtimer_base(timer, base);
if (mode == HRTIMER_MODE_REL) {
tim = ktime_add(tim, new_base->get_time());
tim = ktime_add_safe(tim, new_base->get_time());
/*
* CONFIG_TIME_LOW_RES is a temporary way for architectures
* to signal that they simply return xtime in
@ -848,16 +859,8 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
* timeouts. This will go away with the GTOD framework.
*/
#ifdef CONFIG_TIME_LOW_RES
tim = ktime_add(tim, base->resolution);
tim = ktime_add_safe(tim, base->resolution);
#endif
/*
* Careful here: User space might have asked for a
* very long sleep, so the add above might result in a
* negative number, which enqueues the timer in front
* of the queue.
*/
if (tim.tv64 < 0)
tim.tv64 = KTIME_MAX;
}
timer->expires = tim;

8
kernel/posix-timers.c
View File

@ -767,9 +767,11 @@ common_timer_set(struct k_itimer *timr, int flags,
/* SIGEV_NONE timers are not queued ! See common_timer_get */
if (((timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE)) {
/* Setup correct expiry time for relative timers */
if (mode == HRTIMER_MODE_REL)
timer->expires = ktime_add(timer->expires,
timer->base->get_time());
if (mode == HRTIMER_MODE_REL) {
timer->expires =
ktime_add_safe(timer->expires,
timer->base->get_time());
}
return 0;
}