linux-kernel - Re: Query regarding __hrtimer_get_next

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <eb611e64-6378-d350-e67d-3eed596c365c@codeaurora.org>
Date:   Thu, 26 Oct 2017 19:53:22 +0530
From:   Neeraj Upadhyay <neeraju@...eaurora.org>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     sramana@...eaurora.org, sboyd@...eaurora.org,
        LKML <linux-kernel@...r.kernel.org>,
        John Stultz <john.stultz@...aro.org>
Subject: Re: Query regarding __hrtimer_get_next_event()

Hi tglx,

Forgot to mention, we are using kernel stable version 3.18
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/tree/kernel/time/timekeeping.c?h=v3.18.77

wall time is being set to a value close to epoch
but less than epoch + current uptime.

Looks like 
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/kernel/time?id=e1d7ba8735551ed79c7a0463a042353574b96da3

handles this case, but is not present in 3.18 tree.
We will try by pulling this patch to 3.18 tree.


int do_settimeofday(const struct timespec *tv)
{
xt = tk_xtime(tk);
ts_delta.tv_sec = tv->tv_sec - xt.tv_sec;
ts_delta.tv_nsec = tv->tv_nsec - xt.tv_nsec;

<snip>
tk_set_wall_to_mono(tk, timespec64_sub(tk->wall_to_monotonic, ts_delta));
}

xt = (
tv_sec = 1508807131,
tv_nsec = 223767601)
2017/10/24 9:5:31

tk->wall_to_monotonic = (
tv_sec = -1508803094,
tv_nsec = 15152092)

ts_delta = (tv_sec = -1508803200, tv_nsec = -767601)

wall_to_monotonic is bigger than the ts_delta, so leading
to wall_to_monotonic become positive value, resulting in
-ve off_real.


Thanks
Neeraj


On 10/26/2017 06:27 PM, Thomas Gleixner wrote:
> On Thu, 26 Oct 2017, Neeraj Upadhyay wrote:
>> We have one query regarding the __hrtimer_get_next_event().
>> The expires_next.tv64 is set to 0 if it is < 0. We observed
>> an hrtimer interrupt storm for one of the hrtimers with
>> below properties:
>>
>> * Expires for the hrtimer was set to KTIME_MAX.
>> * cpu base was HRTIMER_BASE_REALTIME with negative base->offset.
>> * Due to below sub, expires overflowed to a negative value and
>>    expires_next.tv64 was set to 0
>>      expires = ktime_sub(hrtimer_get_expires(timer), base->offset);
>> * Due to this, clockevent was programmed to min_delta_ns, everytime
>>    as __hrtimer_get_next_event() returned 0.
>>
>>
>> This may not be a valid use case (queuing a hrtimer with KTIME_MAX)
>> expires, but should we guard the hrtimer next event code against
>> this by using KTIME_MAX upper bound. Is something like below a
>> proper way to guard it? Or am I missing something here?
> Can you please explain how you managed to have a negative base->offset?
>
> Thanks,
>
> 	tglx

-- 
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a
member of the Code Aurora Forum, hosted by The Linux Foundation