linux-kernel - [BUG] clockevents : clockevent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 2 Jul 2007 10:43:39 +0200
From:	Marc Pignat <marc.pignat@...s.ch>
To:	tglx@...utronix.de
Cc:	linux-kernel@...r.kernel.org, "Remy Bohmer" <l.pinguin@...il.com>,
	"David Brownell" <david-b@...bell.net>
Subject: [BUG] clockevents : clockevent_delta2ns usage

Hello all!

We're currently working with David Brownell and Remy Bohmer on implementation
of clocksource/events on the at91rm9200 processor (arm arch).

While debugging our implementation, we came about a rounding problem, in the
setting of min_delta_ns field, and I think it can be in almost all clock_event_device.

Almost all clock_event_device initialize the field min_delta_ns this way:
	clkevt32k.mult = div_sc(CLOCK_TICK_RATE, NSEC_PER_SEC, clkevt32k.shift);
	clkevt32k.max_delta_ns = clockevent_delta2ns(0x000fffff, &clkevt32k);
	clkevt32k.min_delta_ns = clockevent_delta2ns(1, &clkevt32k);

The clockevent_delta2ns function rounds the result down, so the rounded min_delta_ns
can be smaller than the real min_delta_ns.

When clockevents_program_event is called, this rounding problem shows up:
...
	if (delta < dev->min_delta_ns)
		delta = dev->min_delta_ns;

	clc = delta * dev->mult;
	clc >>= dev->shift;

	return dev->set_next_event((unsigned long) clc, dev)

When delta is to small, min_delta_ns will be used, and with a wrong rounding,
will call set_next_event with a value smaller than the expected, and 
set_next_event will fail.

This will result in an infinite loop when clockevents_program_event is called
from tick_program_event with a too short delay.

In our driver, we fixed this problem using that:
-	clkevt32k.min_delta_ns = clockevent_delta2ns(1, &clkevt32k);
+	clkevt32k.min_delta_ns = clockevent_delta2ns(1, &clkevt32k)+1;

I think other clock_event_device can have the same problem.

Regards

Marc
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/