linux-kernel - [PATCH] cpuidle: idle exit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 16 Nov 2023 21:26:19 +0800
From:   Bo Ye <bo.ye@...iatek.com>
To:     "Rafael J. Wysocki" <rafael@...nel.org>,
        Daniel Lezcano <daniel.lezcano@...aro.org>,
        Matthias Brugger <matthias.bgg@...il.com>,
        AngeloGioacchino Del Regno 
        <angelogioacchino.delregno@...labora.com>
CC:     <yongdong.zhang@...iatek.com>, mtk24676 <C.Cheng@...iatek.com>,
        "bo . ye" <bo.ye@...iatek.com>, <linux-pm@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>,
        <linux-arm-kernel@...ts.infradead.org>,
        <linux-mediatek@...ts.infradead.org>
Subject: [PATCH] cpuidle: idle exit_latency overflow

From: mtk24676 <C.Cheng@...iatek.com>

In detail:
In kernel-6.1, in the __cpuidle_driver_init function in
driver/cpuidle/driver.c, there is a line of code that causes
an overflow. The line is s->exit_latency_ns = s->exit_latency
* NSEC_PER_USEC. The overflow occurs because the product of an
int type and a constant exceeds the range of the int type.

In C language, when you perform a multiplication operation, if
both operands are of int type, the multiplication operation is
performed on the int type, and then the result is converted to
the target type. This means that if the product of int type
multiplication exceeds the range that int type can represent,
an overflow will occur even if you store the result in a
variable of int64_t type.

Signed-off-by: mtk24676 <C.Cheng@...iatek.com>
Signed-off-by: bo.ye <bo.ye@...iatek.com>
---

diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c
index d9cda7f..631ca16 100644
--- a/drivers/cpuidle/driver.c
+++ b/drivers/cpuidle/driver.c
@@ -187,7 +187,7 @@
 			s->target_residency = div_u64(s->target_residency_ns, NSEC_PER_USEC);

 		if (s->exit_latency > 0)
-			s->exit_latency_ns = s->exit_latency * NSEC_PER_USEC;
+			s->exit_latency_ns = (u64)s->exit_latency * NSEC_PER_USEC;
 		else if (s->exit_latency_ns < 0)
 			s->exit_latency_ns =  0;
 		else