[lkml]   [2007]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[patch 11/36] hrtimers: avoid overflow for large relative timeouts (CVE-2007-5966)
    2.6.22-stable review patch.  If anyone has any objections, please let us


    From: Thomas Gleixner <>

    patch 62f0f61e6673e67151a7c8c0f9a09c7ea43fe2b5 in mainline

    Relative hrtimers with a large timeout value might end up as negative
    timer values, when the current time is added in hrtimer_start().

    This in turn is causing the clockevents_set_next() function to set an
    huge timeout and sleep for quite a long time when we have a clock
    source which is capable of long sleeps like HPET. With PIT this almost
    goes unnoticed as the maximum delta is ~27ms. The non-hrt/nohz code
    sorts this out in the next timer interrupt, so we never noticed that
    problem which has been there since the first day of hrtimers.

    This bug became more apparent in 2.6.24 which activates HPET on more

    Signed-off-by: Thomas Gleixner <>
    Signed-off-by: Ingo Molnar <>
    Signed-off-by: Greg Kroah-Hartman <>

    kernel/hrtimer.c | 8 ++++++++
    1 file changed, 8 insertions(+)

    --- a/kernel/hrtimer.c
    +++ b/kernel/hrtimer.c
    @@ -825,6 +825,14 @@ hrtimer_start(struct hrtimer *timer, kti
    tim = ktime_add(tim, base->resolution);
    + /*
    + * Careful here: User space might have asked for a
    + * very long sleep, so the add above might result in a
    + * negative number, which enqueues the timer in front
    + * of the queue.
    + */
    + if (tim.tv64 < 0)
    + tim.tv64 = KTIME_MAX;
    timer->expires = tim;


     \ /
      Last update: 2007-12-13 07:43    [W:0.020 / U:17.000 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site