| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 8 Nov 2011 13:02:59 +0800
From: Yong Zhang <yong.zhang0@...il.com>
To: John Stultz <john.stultz@...aro.org>
Cc: Ingo Molnar <mingo@...e.hu>, LKML <linux-kernel@...r.kernel.org>,
David Daney <ddaney.cavm@...il.com>,
Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [PATCH] clocksource: Avoid selecting mult values that might
overflow when adjusted
On Mon, Nov 07, 2011 at 07:09:00PM -0800, John Stultz wrote:
> Yong: Can you also give this a test run to make sure you don't see any
> problems?
Still get warning (3.2-rc1 + your patch):
[ 0.017009] ------------[ cut here ]------------
[ 0.022156] WARNING: at /build/linux/kernel/time/timekeeping.c:828 do_timer+0x402/0x4e0()
[ 0.035917] Adjusting jiffies more then 11% (1024068096 vs 1024064000)
[ 0.043189] Modules linked in:
[ 0.046600] Pid: 0, comm: swapper Not tainted 3.2.0-rc1-10884-g63c2ac8-dirty #17
[ 0.054841] Call Trace:
[ 0.057563] <IRQ> [<ffffffff81050edf>] warn_slowpath_common+0x7f/0xc0
[ 0.064949] [<ffffffff81050fd6>] warn_slowpath_fmt+0x46/0x50
[ 0.071352] [<ffffffff810829e2>] do_timer+0x402/0x4e0
[ 0.077078] [<ffffffff81088a8a>] tick_periodic+0x5a/0x70
[ 0.083094] [<ffffffff81088ac4>] tick_handle_periodic+0x24/0x80
[ 0.089789] [<ffffffff8100482d>] timer_interrupt+0x1d/0x30
[ 0.096000] [<ffffffff810cb9bd>] handle_irq_event_percpu+0x8d/0x360
[ 0.103080] [<ffffffff810cbcd8>] handle_irq_event+0x48/0x70
[ 0.109386] [<ffffffff810cf0be>] ? handle_level_irq+0x1e/0xe0
[ 0.115886] [<ffffffff810cf112>] handle_level_irq+0x72/0xe0
[ 0.122191] [<ffffffff81004002>] handle_irq+0x22/0x30
[ 0.127917] [<ffffffff815f256d>] do_IRQ+0x5d/0xe0
[ 0.133256] [<ffffffff815ef6b0>] common_interrupt+0x70/0x70
[ 0.139561] <EOI> [<ffffffff810425de>] ? sub_preempt_count+0xe/0xe0
[ 0.146751] [<ffffffff815ef4a8>] ? _raw_spin_unlock_irqrestore+0x38/0x80
[ 0.154315] [<ffffffff81052136>] ? vprintk+0x316/0x4d0
[ 0.160139] [<ffffffff815e146d>] ? calibrate_delay+0x4e4/0x504
[ 0.166727] [<ffffffff815ea3d0>] printk+0x68/0x70
[ 0.172067] [<ffffffff81acc9ce>] pidmap_init+0x6e/0xbd
[ 0.177891] [<ffffffff81ab7be7>] start_kernel+0x312/0x38a
[ 0.184004] [<ffffffff81ab7321>] x86_64_start_reservations+0x131/0x135
[ 0.191375] [<ffffffff81ab7412>] x86_64_start_kernel+0xed/0xf4
[ 0.198109] ---[ end trace 4eaa2a86a8e2da22 ]---
Full dmesg is attached.
Thanks,
Yong
>
> thanks
> -john
>
> >From 82c5b70fc5074b6bb6e05514afb6e9c73c740422 Mon Sep 17 00:00:00 2001
> From: John Stultz <john.stultz@...aro.org>
> Date: Mon, 31 Oct 2011 17:06:35 -0400
> Subject: [PATCH] clocksource: Avoid selecting mult values that might overflow when adjusted
>
> For some frequqencies, the clocks_calc_mult_shift() function will
> unfortunately select mult values very close to 0xffffffff. This
> has the potential to overflow when NTP adjusts the clock, adding
> to the mult value.
>
> This patch adds a clocksource.maxadj value, which provides
> an approximation of an 11% adjustment(NTP limits adjustments to
> 500ppm and the tick adjustment is limited to 10%), which could
> be made to the clocksource.mult value. This is then used to both
> check that the current mult value won't overflow/underflow, as
> well as warning us if the timekeeping_adjust() code pushes over
> that 11% boundary.
>
> v2: Fix max_adjustment calculation, and improve WARN_ONCE
> messages.
>
> CC: Yong Zhang <yong.zhang0@...il.com>
> CC: David Daney <ddaney.cavm@...il.com>
> CC: Thomas Gleixner <tglx@...utronix.de>
> Reported-by: Chen Jie <chenj@...ote.com>
> Reported-by: zhangfx <zhangfx@...ote.com>
> Signed-off-by: John Stultz <john.stultz@...aro.org>
> ---
> include/linux/clocksource.h | 3 +-
> kernel/time/clocksource.c | 58 +++++++++++++++++++++++++++++++++++-------
> kernel/time/timekeeping.c | 6 ++++
> 3 files changed, 56 insertions(+), 11 deletions(-)
>
> diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
> index 139c4db..c86c940 100644
> --- a/include/linux/clocksource.h
> +++ b/include/linux/clocksource.h
> @@ -156,6 +156,7 @@ extern u64 timecounter_cyc2time(struct timecounter *tc,
> * @mult: cycle to nanosecond multiplier
> * @shift: cycle to nanosecond divisor (power of two)
> * @max_idle_ns: max idle time permitted by the clocksource (nsecs)
> + * @maxadj maximum adjustment value to mult (~11%)
> * @flags: flags describing special properties
> * @archdata: arch-specific data
> * @suspend: suspend function for the clocksource, if necessary
> @@ -172,7 +173,7 @@ struct clocksource {
> u32 mult;
> u32 shift;
> u64 max_idle_ns;
> -
> + u32 maxadj;
> #ifdef CONFIG_ARCH_CLOCKSOURCE_DATA
> struct arch_clocksource_data archdata;
> #endif
> diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
> index cf52fda..cfc65e1 100644
> --- a/kernel/time/clocksource.c
> +++ b/kernel/time/clocksource.c
> @@ -492,6 +492,22 @@ void clocksource_touch_watchdog(void)
> }
>
> /**
> + * clocksource_max_adjustment- Returns max adjustment amount
> + * @cs: Pointer to clocksource
> + *
> + */
> +static u32 clocksource_max_adjustment(struct clocksource *cs)
> +{
> + u64 ret;
> + /*
> + * We won't try to correct for more then 11% adjustments (110,000 ppm),
> + */
> + ret = (u64)cs->mult * 11;
> + do_div(ret,100);
> + return (u32)ret;
> +}
> +
> +/**
> * clocksource_max_deferment - Returns max time the clocksource can be deferred
> * @cs: Pointer to clocksource
> *
> @@ -503,25 +519,28 @@ static u64 clocksource_max_deferment(struct clocksource *cs)
> /*
> * Calculate the maximum number of cycles that we can pass to the
> * cyc2ns function without overflowing a 64-bit signed result. The
> - * maximum number of cycles is equal to ULLONG_MAX/cs->mult which
> - * is equivalent to the below.
> - * max_cycles < (2^63)/cs->mult
> - * max_cycles < 2^(log2((2^63)/cs->mult))
> - * max_cycles < 2^(log2(2^63) - log2(cs->mult))
> - * max_cycles < 2^(63 - log2(cs->mult))
> - * max_cycles < 1 << (63 - log2(cs->mult))
> + * maximum number of cycles is equal to ULLONG_MAX/(cs->mult+cs->maxadj)
> + * which is equivalent to the below.
> + * max_cycles < (2^63)/(cs->mult + cs->maxadj)
> + * max_cycles < 2^(log2((2^63)/(cs->mult + cs->maxadj)))
> + * max_cycles < 2^(log2(2^63) - log2(cs->mult + cs->maxadj))
> + * max_cycles < 2^(63 - log2(cs->mult + cs->maxadj))
> + * max_cycles < 1 << (63 - log2(cs->mult + cs->maxadj))
> * Please note that we add 1 to the result of the log2 to account for
> * any rounding errors, ensure the above inequality is satisfied and
> * no overflow will occur.
> */
> - max_cycles = 1ULL << (63 - (ilog2(cs->mult) + 1));
> + max_cycles = 1ULL << (63 - (ilog2(cs->mult + cs->maxadj) + 1));
>
> /*
> * The actual maximum number of cycles we can defer the clocksource is
> * determined by the minimum of max_cycles and cs->mask.
> + * Note: Here we subtract the maxadj to make sure we don't sleep for
> + * too long if there's a large negative adjustment.
> */
> max_cycles = min_t(u64, max_cycles, (u64) cs->mask);
> - max_nsecs = clocksource_cyc2ns(max_cycles, cs->mult, cs->shift);
> + max_nsecs = clocksource_cyc2ns(max_cycles, cs->mult - cs->maxadj,
> + cs->shift);
>
> /*
> * To ensure that the clocksource does not wrap whilst we are idle,
> @@ -640,7 +659,6 @@ static void clocksource_enqueue(struct clocksource *cs)
> void __clocksource_updatefreq_scale(struct clocksource *cs, u32 scale, u32 freq)
> {
> u64 sec;
> -
> /*
> * Calc the maximum number of seconds which we can run before
> * wrapping around. For clocksources which have a mask > 32bit
> @@ -661,6 +679,20 @@ void __clocksource_updatefreq_scale(struct clocksource *cs, u32 scale, u32 freq)
>
> clocks_calc_mult_shift(&cs->mult, &cs->shift, freq,
> NSEC_PER_SEC / scale, sec * scale);
> +
> + /*
> + * for clocksources that have large mults, to avoid overflow.
> + * Since mult may be adjusted by ntp, add an safety extra margin
> + *
> + */
> + cs->maxadj = clocksource_max_adjustment(cs);
> + while ((cs->mult + cs->maxadj < cs->mult)
> + || (cs->mult - cs->maxadj > cs->mult)) {
> + cs->mult >>= 1;
> + cs->shift--;
> + cs->maxadj = clocksource_max_adjustment(cs);
> + }
> +
> cs->max_idle_ns = clocksource_max_deferment(cs);
> }
> EXPORT_SYMBOL_GPL(__clocksource_updatefreq_scale);
> @@ -701,6 +733,12 @@ EXPORT_SYMBOL_GPL(__clocksource_register_scale);
> */
> int clocksource_register(struct clocksource *cs)
> {
> + /* calculate max adjustment for given mult/shift */
> + cs->maxadj = clocksource_max_adjustment(cs);
> + WARN_ONCE(cs->mult + cs->maxadj < cs->mult,
> + "Clocksource %s might overflow on 11%% adjustment\n",
> + cs->name);
> +
> /* calculate max idle time permitted for this clocksource */
> cs->max_idle_ns = clocksource_max_deferment(cs);
>
> diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
> index 2b021b0e..2c04610 100644
> --- a/kernel/time/timekeeping.c
> +++ b/kernel/time/timekeeping.c
> @@ -820,6 +820,12 @@ static void timekeeping_adjust(s64 offset)
> } else
> return;
>
> + WARN_ONCE(timekeeper.mult+adj >
> + timekeeper.clock->mult + timekeeper.clock->maxadj,
> + "Adjusting %s more then 11%% (%ld vs %ld)\n",
> + timekeeper.clock->name, (long)timekeeper.mult+adj,
> + (long)timekeeper.clock->mult +
> + timekeeper.clock->maxadj);
> timekeeper.mult += adj;
> timekeeper.xtime_interval += interval;
> timekeeper.xtime_nsec -= offset;
> --
> 1.7.3.2.146.gca209
>
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
--
Only stand for myself
View attachment "3.2-rc1.log" of type "text/plain" (60429 bytes)
Powered by blists - more mailing lists