linux-kernel - Re: [patch 09/45] posix-cpu-timers: Fix posix_cpu_timer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 27 Jun 2023 00:46:05 +0200
From:   Frederic Weisbecker <frederic@...nel.org>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Anna-Maria Behnsen <anna-maria@...utronix.de>,
        John Stultz <jstultz@...gle.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...nel.org>,
        Stephen Boyd <sboyd@...nel.org>,
        Eric Biederman <ebiederm@...ssion.com>,
        Oleg Nesterov <oleg@...hat.com>
Subject: Re: [patch 09/45] posix-cpu-timers: Fix posix_cpu_timer_get()
 behaviour

On Tue, Jun 06, 2023 at 04:37:33PM +0200, Thomas Gleixner wrote:
> timer_gettime() must return the remaining time to the next expiry of a
> timer or 0 if the timer is not armed and no signal pending.
> 
> This has to be correct also for interval timers even if the signal is
> pending or the timer has been created with SIGEV_NONE.
> 
> The posix CPU timer implementation fails for both cases as it does not
> forward the timer in posix_cpu_timer_get() before calculating the expiry
> time.
> 
> It neither clears the expiry value when a oneshot SIGEV_NONE timer expired
> and returns 1nsec instead, which is only correct for timers with signals
> when the signal delivery did not happen yet.
> 
> Aside of that posix_cpu_timer_set() pointlessly arms SIGEV_NONE timers
> which are later disarmed when the initial expiry happens. That's bogus and
> just keeping the process wide timer active for nothing.
> 
> Cure this by:
> 
>      1) Avoiding to arm SIGEV_NONE timers
> 
>      2) Forwarding interval timers in posix_cpu_timer_get()
> 
>      3) Taking SIGEV_NONE into account when a oneshot timer has expired

This patch does too many things at once...

> 
> Make the update logic a separate function so it can be reused to simplify
> posix_cpu_timer_set().
> 
> Fixes: ae1a78eecc45 ("cpu-timers: Return correct previous timer reload value")
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> ---
>  kernel/time/posix-cpu-timers.c |   96 +++++++++++++++++++++++------------------
>  1 file changed, 54 insertions(+), 42 deletions(-)
> 
> --- a/kernel/time/posix-cpu-timers.c
> +++ b/kernel/time/posix-cpu-timers.c
> @@ -785,45 +782,60 @@ static int posix_cpu_timer_set(struct k_
>  	return ret;
>  }
>  
> -static void posix_cpu_timer_get(struct k_itimer *timer, struct itimerspec64 *itp)
> +static void __posix_cpu_timer_get(struct k_itimer *timer, struct itimerspec64 *itp, u64 now)
>  {
> -	clockid_t clkid = CPUCLOCK_WHICH(timer->it_clock);
> -	struct cpu_timer *ctmr = &timer->it.cpu;
> -	u64 now, expires = cpu_timer_getexpires(ctmr);
> -	struct task_struct *p;
> -
> -	rcu_read_lock();
> -	p = cpu_timer_task_rcu(timer);
> -	if (!p)
> -		goto out;
> +	bool sigev_none = timer->it_sigev_notify == SIGEV_NONE;
> +	u64 expires;
>  
>  	/*
> -	 * Easy part: convert the reload time.
> +	 * Make sure that interval timers are moved forward for the
> +	 * following cases:
> +	 *  - SIGEV_NONE timers which are never armed
> +	 *  - Timers which expired, but the signal has not yet been
> +	 *    delivered
>  	 */
> -	itp->it_interval = ktime_to_timespec64(timer->it_interval);
> -
> -	if (!expires)
> -		goto out;
> +	expires = bump_cpu_timer(timer, now);

What if the expiration has been reached but we arrived here before
handle_posix_cpu_timers() had a chance? In that case the call to
bump_cpu_timer() may forward the timer and artificially create an
overrun / missed event.

Also we are not holding the sighand lock here. So even though the timer
is forwarded, it may still be picked up afterward by check_thread_timers()
based on its stalled previous expires value... This can create a discrepancy
between the overrun count and the actual events received, and perhaps other
funny things...

Thanks.

>  
>  	/*
> -	 * Sample the clock to take the difference with the expiry time.
> +	 * Interval timers cannot have a remaining time <= 0 because the
> +	 * forwarding guarantees to move them forward so that the next
> +	 * timer expiry is > @now.
>  	 */
> -	if (CPUCLOCK_PERTHREAD(timer->it_clock))
> -		now = cpu_clock_sample(clkid, p);
> -	else
> -		now = cpu_clock_sample_group(clkid, p, false);
> -
>  	if (now < expires) {
>  		itp->it_value = ns_to_timespec64(expires - now);
>  	} else {
>  		/*
> -		 * The timer should have expired already, but the firing
> -		 * hasn't taken place yet.  Say it's just about to expire.
> +		 * A single shot SIGEV_NONE timer must return 0, when it is
> +		 * expired! Timers which have a real signal delivery mode
> +		 * must return a remaining time greater than 0 because the
> +		 * signal has not yet been delivered.
>  		 */
> -		itp->it_value.tv_nsec = 1;
> -		itp->it_value.tv_sec = 0;
> +		if (!sigev_none)
> +			itp->it_value.tv_nsec = 1;
> +	}
> +}