From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1422640AbWJDRmb (ORCPT ); Wed, 4 Oct 2006 13:42:31 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1422642AbWJDRmI (ORCPT ); Wed, 4 Oct 2006 13:42:08 -0400 Received: from www.osadl.org ([213.239.205.134]:8421 "EHLO mail.tglx.de") by vger.kernel.org with ESMTP id S1161154AbWJDRhw (ORCPT ); Wed, 4 Oct 2006 13:37:52 -0400 Message-Id: <20061004172222.440991000@cruncher.tec.linutronix.de> References: <20061004172217.092570000@cruncher.tec.linutronix.de> Date: Wed, 04 Oct 2006 17:31:35 -0000 From: Thomas Gleixner To: Andrew Morton Cc: LKML , Ingo Molnar , John Stultz , Valdis Kletnieks , Arjan van de Ven , Dave Jones , David Woodhouse , Jim Gettys , Roman Zippel Subject: [patch 05/22] time: fix msecs_to_jiffies() bug Content-Disposition: inline; filename=time-fix-msecs_to_jiffies-bug.patch Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org From: Ingo Molnar Fix multiple conversion bugs in msecs_to_jiffies(). The main problem is that this condition: if (m > jiffies_to_msecs(MAX_JIFFY_OFFSET)) overflows if HZ is smaller than 1000! This change is user-visible: for HZ=250 SUS-compliant poll()-timeout value of -20 is mistakenly converted to 'immediate timeout'. (The new dyntick code also triggered this, as it frequently creates 'lagging timer wheel' scenarios.) Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner kernel/time.c | 43 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-) Index: linux-2.6.18-mm3/kernel/time.c =================================================================== --- linux-2.6.18-mm3.orig/kernel/time.c 2006-10-04 18:13:54.000000000 +0200 +++ linux-2.6.18-mm3/kernel/time.c 2006-10-04 18:13:54.000000000 +0200 @@ -500,15 +500,56 @@ unsigned int jiffies_to_usecs(const unsi } EXPORT_SYMBOL(jiffies_to_usecs); +/* + * When we convert to jiffies then we interpret incoming values + * the following way: + * + * - negative values mean 'infinite timeout' (MAX_JIFFY_OFFSET) + * + * - 'too large' values [that would result in larger than + * MAX_JIFFY_OFFSET values] mean 'infinite timeout' too. + * + * - all other values are converted to jiffies by either multiplying + * the input value by a factor or dividing it with a factor + * + * We must also be careful about 32-bit overflows. + */ unsigned long msecs_to_jiffies(const unsigned int m) { - if (m > jiffies_to_msecs(MAX_JIFFY_OFFSET)) + /* + * Negative value, means infinite timeout: + */ + if ((int)m < 0) return MAX_JIFFY_OFFSET; + #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ) + /* + * HZ is equal to or smaller than 1000, and 1000 is a nice + * round multiple of HZ, divide with the factor between them, + * but round upwards: + */ return (m + (MSEC_PER_SEC / HZ) - 1) / (MSEC_PER_SEC / HZ); #elif HZ > MSEC_PER_SEC && !(HZ % MSEC_PER_SEC) + /* + * HZ is larger than 1000, and HZ is a nice round multiple of + * 1000 - simply multiply with the factor between them. + * + * But first make sure the multiplication result cannot + * overflow: + */ + if (m > jiffies_to_msecs(MAX_JIFFY_OFFSET)) + return MAX_JIFFY_OFFSET; + return m * (HZ / MSEC_PER_SEC); #else + /* + * Generic case - multiply, round and divide. But first + * check that if we are doing a net multiplication, that + * we wouldnt overflow: + */ + if (HZ > MSEC_PER_SEC && m > jiffies_to_msecs(MAX_JIFFY_OFFSET)) + return MAX_JIFFY_OFFSET; + return (m * HZ + MSEC_PER_SEC - 1) / MSEC_PER_SEC; #endif } --