netdev - Re: [PATCH v1 net 1/1] net: avoid overflow when rose /proc displays timer information.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 2 Aug 2022 18:57:43 +0200
From:   Bernard f6bvp <f6bvp@...e.fr>
To:     Francois Romieu <romieu@...zoreil.com>, netdev@...r.kernel.org
Cc:     edumazet@...gle.com, davem@...emloft.net, kuba@...nel.org,
        pabeni@...hat.com, thomas@...erried.de, thomas@...erg.in-berlin.de,
        linux-hams@...r.kernel.org
Subject: Re: [PATCH v1 net 1/1] net: avoid overflow when rose /proc displays
 timer information.

rose /proc code does not serialize timer accesses.

Initial report by Bernard F6BVP Pidoux exhibits overflow amounting
to 116 ticks on its HZ=250 system.

Full timer access serialization would imho be overkill as rose /proc
does not enforce consistency between displayed ROSE_STATE_XYZ and
timer values during changes of state.

The patch may also fix similar behavior in ax25 /proc, ax25 ioctl
and netrom /proc as they all exhibit the same timer serialization
policy. This point has not been reported though.

The sole remaining use of ax25_display_timer - ax25 rtt valuation -
may also perform marginally better but I have not analyzed it too
deeply.

Signed-off-by: Francois Romieu <romieu@...zoreil.com>
Tested-by: Bernard Pidoux <f6bvp@...e.fr>
Cc: Thomas DL9SAU Osterried <thomas@...erried.de>
Link: https://lore.kernel.org/all/d5e93cc7-a91f-13d3-49a1-b50c11f0f811@free.fr/
---
  net/ax25/ax25_timer.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)

Bernard, can you formally test and add your "Tested-by:" on this one ?

diff --git a/net/ax25/ax25_timer.c b/net/ax25/ax25_timer.c
index 85865ebfdfa2..9f7cb0a7c73f 100644
--- a/net/ax25/ax25_timer.c
+++ b/net/ax25/ax25_timer.c
@@ -108,10 +108,12 @@ int ax25_t1timer_running(ax25_cb *ax25)

  unsigned long ax25_display_timer(struct timer_list *timer)
  {
+	long delta = timer->expires - jiffies;
+
  	if (!timer_pending(timer))
  		return 0;

-	return timer->expires - jiffies;
+	return max(0L, delta);
  }

  EXPORT_SYMBOL(ax25_display_timer);