linux-kernel - query on linux kernel timer implementation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CACAVd4gjA0iwooWomJ+1CmhVRo3kDzEh0dSEKh2dXuZ-ZSHqnQ@mail.gmail.com>
Date:   Wed, 31 Jul 2019 17:11:44 +0530
From:   Arul Jeniston <arul.jeniston@...il.com>
To:     linux-kernel@...r.kernel.org
Cc:     arul_mc@...l.com
Subject: query on linux kernel timer implementation

Hi Team,

We have a query on the implementation linux timer implementation.

We have been running our application on linux kernel 4.9.168 (debian -
stretch) version. We use intel Rangeley 4 cpu system which has tsc
timer. Our application is an multi-threaded program which creates a
monotonic timer-fd  object, sets one second expiry time and does read
on the timer object infinitely. Once in a while, we face an anomaly in
the return value of timerfd read call.

As per the man page, read on timer fd
(http://man7.org/linux/man-pages/man2/timerfd_create.2.html) returns 8
or -1 but we observed read returns 0.

While debugging, we found timerfd_read function returns 0 when the
amount of negative tsc clock drift goes above certain boundary
condition. Through instrumentation, we found the following sequence of
code flow gets hit and causes timerfd_read to return 0.

Please find the below sequence of code that leads to this anomaly.

read(timerfd,…) --> timerfd_read() --->  hrtimer_forward_now --->
hrtimer_forward() return 0 if expiry time is greater than current
time. Timer object expire time becomes greater than current time due
to negative tsc clock drift.

We like to know whether returning 0 from timerfd_read is expected?

      - If yes, can we document it in timerfd read man page?

      - If no, can we do the needful to address this problem in Linux?

Please cc me in all the discussions happening on this post.

Regards,
Arul