[lkml]   [2017]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 3.2 057/106] alarmtimer: Prevent overflow of relative timers
3.2.93-rc1 review patch.  If anyone has any objections, please let me know.


From: Thomas Gleixner <>

commit f4781e76f90df7aec400635d73ea4c35ee1d4765 upstream.

Andrey reported a alartimer related RCU stall while fuzzing the kernel with

The reason for this is an overflow in ktime_add() which brings the
resulting time into negative space and causes immediate expiry of the
timer. The following rearm with a small interval does not bring the timer
back into positive space due to the same issue.

This results in a permanent firing alarmtimer which hogs the CPU.

Use ktime_add_safe() instead which detects the overflow and clamps the
result to KTIME_SEC_MAX.

Reported-by: Andrey Konovalov <>
Signed-off-by: Thomas Gleixner <>
Cc: Peter Zijlstra <>
Cc: Kostya Serebryany <>
Cc: syzkaller <>
Cc: John Stultz <>
Cc: Dmitry Vyukov <>
[bwh: Backported to 3.2: drop change in alarm_start_relative()]
Signed-off-by: Ben Hutchings <>
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -419,7 +419,7 @@ u64 alarm_forward(struct alarm *alarm, k

- alarm->node.expires = ktime_add(alarm->node.expires, interval);
+ alarm->node.expires = ktime_add_safe(alarm->node.expires, interval);
return overrun;

@@ -604,7 +604,7 @@ static int alarm_timer_set(struct k_itim
ktime_t now;

now = alarm_bases[timr->it.alarm.alarmtimer.type].gettime();
- exp = ktime_add(now, exp);
+ exp = ktime_add_safe(now, exp);

alarm_start(&timr->it.alarm.alarmtimer, exp);
 \ /
  Last update: 2017-09-10 00:39    [W:0.259 / U:4.968 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site