lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 26 Oct 2017 19:53:22 +0530
From:   Neeraj Upadhyay <>
To:     Thomas Gleixner <>
        LKML <>,
        John Stultz <>
Subject: Re: Query regarding __hrtimer_get_next_event()

Hi tglx,

Forgot to mention, we are using kernel stable version 3.18

wall time is being set to a value close to epoch
but less than epoch + current uptime.

Looks like

handles this case, but is not present in 3.18 tree.
We will try by pulling this patch to 3.18 tree.

int do_settimeofday(const struct timespec *tv)
xt = tk_xtime(tk);
ts_delta.tv_sec = tv->tv_sec - xt.tv_sec;
ts_delta.tv_nsec = tv->tv_nsec - xt.tv_nsec;

tk_set_wall_to_mono(tk, timespec64_sub(tk->wall_to_monotonic, ts_delta));

xt = (
tv_sec = 1508807131,
tv_nsec = 223767601)
2017/10/24 9:5:31

tk->wall_to_monotonic = (
tv_sec = -1508803094,
tv_nsec = 15152092)

ts_delta = (tv_sec = -1508803200, tv_nsec = -767601)

wall_to_monotonic is bigger than the ts_delta, so leading
to wall_to_monotonic become positive value, resulting in
-ve off_real.


On 10/26/2017 06:27 PM, Thomas Gleixner wrote:
> On Thu, 26 Oct 2017, Neeraj Upadhyay wrote:
>> We have one query regarding the __hrtimer_get_next_event().
>> The expires_next.tv64 is set to 0 if it is < 0. We observed
>> an hrtimer interrupt storm for one of the hrtimers with
>> below properties:
>> * Expires for the hrtimer was set to KTIME_MAX.
>> * cpu base was HRTIMER_BASE_REALTIME with negative base->offset.
>> * Due to below sub, expires overflowed to a negative value and
>>    expires_next.tv64 was set to 0
>>      expires = ktime_sub(hrtimer_get_expires(timer), base->offset);
>> * Due to this, clockevent was programmed to min_delta_ns, everytime
>>    as __hrtimer_get_next_event() returned 0.
>> This may not be a valid use case (queuing a hrtimer with KTIME_MAX)
>> expires, but should we guard the hrtimer next event code against
>> this by using KTIME_MAX upper bound. Is something like below a
>> proper way to guard it? Or am I missing something here?
> Can you please explain how you managed to have a negative base->offset?
> Thanks,
> 	tglx

QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a
member of the Code Aurora Forum, hosted by The Linux Foundation

Powered by blists - more mailing lists