linux-kernel - [RFC PATCH] timer: Fix bucket

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 12 May 2021 20:15:29 +0800
From:   Xiongfeng Wang <wangxiongfeng2@...wei.com>
To:     <john.stultz@...aro.org>, <tglx@...utronix.de>, <sboyd@...nel.org>
CC:     <linux-kernel@...r.kernel.org>, <wangxiongfeng2@...wei.com>
Subject: [RFC PATCH] timer: Fix bucket_expiry calculation

When I use schedule_timeout(5) to put a process into sleep on my machine
with HZ = 100. It always sleep about 60ms. I enable the timer trace and
find out, when the timer_list expires, 'now' is always equal to
'expires + 1'. I print 'base->next_expiry' in '__run_timers' and find out
'next_expiry' is always equal to 'expires + 1';

  my_test_thread-1230    [001] d...   382.627089: timer_start: timer=000000004ec021c9 function=process_timeout expires=4294975072 [timeout=5] cpu=1 idx=33 flags=
          <idle>-0       [001] ..s.   382.687082: run_timer_softirq: jiffies 4294975073  next_expiry 4294975073
          <idle>-0       [001] ..s.   382.687083: timer_expire_entry: timer=000000004ec021c9 function=process_timeout now=4294975073 baseclk=4294975073
  my_test_thread-1230    [001] d...   382.687089: timer_start: timer=000000004ec021c9 function=process_timeout expires=4294975078 [timeout=5] cpu=1 idx=39 flags=
          <idle>-0       [001] ..s.   382.747083: run_timer_softirq: jiffies 4294975079  next_expiry 4294975079
          <idle>-0       [001] ..s.   382.747084: timer_expire_entry: timer=000000004ec021c9 function=process_timeout now=4294975079 baseclk=4294975079

It is because we use the following equation to calculate bucket_expiry.

  bucket_expiry = ((expires + LVL_GRAN(lvl)) >> LVL_SHIFT(lvl)) << LVL_SHIFT(lvl)

'bucket_expiry' is equal to 'expires + 1' when lvl = 0. So modify the
equation as follows to fix the issue.

  bucket_expiry = ((expires + LVL_GRAN(lvl) - 1) >> LVL_SHIFT(lvl)) << LVL_SHIFT(lvl)

Signed-off-by: Xiongfeng Wang <wangxiongfeng2@...wei.com>
---
 kernel/time/timer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index d111adf..a6a26da 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -501,7 +501,7 @@ static inline unsigned calc_index(unsigned long expires, unsigned lvl,
 	 *
 	 * Round up with level granularity to prevent this.
 	 */
-	expires = (expires + LVL_GRAN(lvl)) >> LVL_SHIFT(lvl);
+	expires = (expires + LVL_GRAN(lvl) - 1) >> LVL_SHIFT(lvl);
 	*bucket_expiry = expires << LVL_SHIFT(lvl);
 	return LVL_OFFS(lvl) + (expires & LVL_MASK);
 }
-- 
1.7.12.4