[PATCH] sysctl: Fix large millisecond-to-jiffies conversions

[PATCH] sysctl: Fix large millisecond-to-jiffies conversions

[Avi Weiss]

sysctl_msecs_to_jiffies() compares the input against
jiffies_to_msecs(MAX_JIFFY_OFFSET), which returns an unsigned int.
When the converted limit exceeds UINT_MAX, it is truncated, causing
valid timeouts to be incorrectly saturated to MAX_JIFFY_OFFSET.
For example, on 32-bit systems with HZ=100, writing 2147483647 ms
stores 1073741822 jiffies instead of 214748365.

For unsigned long sysctls, values between INT_MAX and UINT_MAX
are passed to msecs_to_jiffies(), which interprets them as negative
timeouts. On 64-bit systems with HZ=1000, writing 2147483648 ms
stores MAX_JIFFY_OFFSET instead of 2147483648 jiffies.

Keep the existing conversion for values up to INT_MAX, and use
overflow-safe, full-width arithmetic for larger values. Clamp
the result to MAX_JIFFY_OFFSET.

Fixes: afdf35cfae0d ("sysctl: Fix type truncation in sysctl_msec_to_jiffies")
Fixes: b96b5c6708ea ("sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
 kernel/time/jiffies.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
index af1c69bf0c23..7b02cc7de15e 100644
--- a/kernel/time/jiffies.c
+++ b/kernel/time/jiffies.c
@@ -139,9 +139,20 @@ static int sysctl_k2u_int_conv_userhz(bool *negp, ulong *u_ptr, const int *k_ptr
 
 static ulong sysctl_msecs_to_jiffies(const ulong val)
 {
-	if (val > jiffies_to_msecs(MAX_JIFFY_OFFSET))
-		return MAX_JIFFY_OFFSET;
-	return msecs_to_jiffies(val);
+	ulong secs, jif;
+
+	if (val <= INT_MAX) {
+		jif = msecs_to_jiffies(val);
+	} else {
+		secs = val / MSEC_PER_SEC;
+		if (secs > MAX_JIFFY_OFFSET / HZ)
+			return MAX_JIFFY_OFFSET;
+
+		jif = secs * HZ +
+		      DIV_ROUND_UP((val % MSEC_PER_SEC) * HZ, MSEC_PER_SEC);
+	}
+
+	return min_t(ulong, jif, MAX_JIFFY_OFFSET);
 }
 
 static int sysctl_u2k_int_conv_ms(const bool *negp, const ulong *u_ptr, int *k_ptr)

base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e
-- 
2.43.0

Re: [PATCH] sysctl: Fix large millisecond-to-jiffies conversions

[Joel Granados]

[-- Attachment #1: Type: text/plain, Size: 4555 bytes --]

On Mon, Nov 02, 2026 at 01:15:17PM +0200, Avi Weiss wrote:
> sysctl_msecs_to_jiffies() compares the input against
> jiffies_to_msecs(MAX_JIFFY_OFFSET), which returns an unsigned int.
> When the converted limit exceeds UINT_MAX, it is truncated, causing
> valid timeouts to be incorrectly saturated to MAX_JIFFY_OFFSET.
> For example, on 32-bit systems with HZ=100, writing 2147483647 ms
> stores 1073741822 jiffies instead of 214748365.
> 
> For unsigned long sysctls, values between INT_MAX and UINT_MAX
> are passed to msecs_to_jiffies(), which interprets them as negative
> timeouts. On 64-bit systems with HZ=1000, writing 2147483648 ms
> stores MAX_JIFFY_OFFSET instead of 2147483648 jiffies.
> 
> Keep the existing conversion for values up to INT_MAX, and use
> overflow-safe, full-width arithmetic for larger values. Clamp
> the result to MAX_JIFFY_OFFSET.
> 
> Fixes: afdf35cfae0d ("sysctl: Fix type truncation in sysctl_msec_to_jiffies")
> Fixes: b96b5c6708ea ("sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec")
> Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>

This is a very good catch and it teaches me never to assume that the
function will take care of everything.

With b96b5c6708ea ("sysctl: Replace do_proc_do{int,ulong,uint}vec with
do_proc_vec") I wanted (naively) to remove the additional conversion
logic and just use the one that already existed in msecs_to_jiffies and
jiffies_to_msecs. This has proven to be a bad idea as going from the
ulong space (of sysctl converter) to the uint space (of msecs_to_jiffies
& jiffies_to_msecs) creates lots of churn.

> ---
>  kernel/time/jiffies.c | 17 ++++++++++++++---
>  1 file changed, 14 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
> index af1c69bf0c23..7b02cc7de15e 100644
> --- a/kernel/time/jiffies.c
> +++ b/kernel/time/jiffies.c
> @@ -139,9 +139,20 @@ static int sysctl_k2u_int_conv_userhz(bool *negp, ulong *u_ptr, const int *k_ptr
>  
>  static ulong sysctl_msecs_to_jiffies(const ulong val)
>  {
> -	if (val > jiffies_to_msecs(MAX_JIFFY_OFFSET))
> -		return MAX_JIFFY_OFFSET;
> -	return msecs_to_jiffies(val);
> +	ulong secs, jif;
> +
> +	if (val <= INT_MAX) {
> +		jif = msecs_to_jiffies(val);
> +	} else {
> +		secs = val / MSEC_PER_SEC;
> +		if (secs > MAX_JIFFY_OFFSET / HZ)
> +			return MAX_JIFFY_OFFSET;
> +
> +		jif = secs * HZ +
> +		      DIV_ROUND_UP((val % MSEC_PER_SEC) * HZ, MSEC_PER_SEC);
> +	}
> +
> +	return min_t(ulong, jif, MAX_JIFFY_OFFSET);
>  }
>  
>  static int sysctl_u2k_int_conv_ms(const bool *negp, const ulong *u_ptr, int *k_ptr)
> 
> base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e
> -- 
> 2.43.0
> 

Lets go back to having an additional ulong conversion in sysctl. And
forget about using the msecs_to_jiffies and jiffies_to_msecs functions.
Also, lets document it so we don't forget.

How about we do it like this (compiled but untested)

diff --git i/kernel/time/jiffies.c w/kernel/time/jiffies.c
index af1c69bf0c23..409106d194cd 100644
--- i/kernel/time/jiffies.c
+++ w/kernel/time/jiffies.c
@@ -137,11 +137,19 @@ static int sysctl_k2u_int_conv_userhz(bool *negp, ulong *u_ptr, const int *k_ptr
        return proc_int_k2u_conv_kop(u_ptr, k_ptr, negp, sysctl_jiffies_to_clock_t);
 }

+/*
+ * We do not use jiffies_to_msecs and msecs_to_jiffies here to avoid having
+ * to deal with the unsined int space. Millisecond <-> jiffies conversions
+ * for sysctls, done in unsigned long arithmetic.
+ */
 static ulong sysctl_msecs_to_jiffies(const ulong val)
 {
-       if (val > jiffies_to_msecs(MAX_JIFFY_OFFSET))
-               return MAX_JIFFY_OFFSET;
-       return msecs_to_jiffies(val);
+       ulong secs = val / MSEC_PER_SEC;
+
+       if (secs >= ULONG_MAX / HZ)
+               return ULONG_MAX;
+
+       return secs * HZ + DIV_ROUND_UP((val % MSEC_PER_SEC) * HZ, MSEC_PER_SEC);
 }

 static int sysctl_u2k_int_conv_ms(const bool *negp, const ulong *u_ptr, int *k_ptr)
@@ -151,7 +159,12 @@ static int sysctl_u2k_int_conv_ms(const bool *negp, const ulong *u_ptr, int *k_p

 static ulong sysctl_jiffies_to_msecs(const ulong val)
 {
-       return jiffies_to_msecs(val);
+       ulong secs = val / HZ;
+
+       if (secs >= ULONG_MAX / MSEC_PER_SEC)
+               return ULONG_MAX;
+
+       return secs * MSEC_PER_SEC + (val % HZ) * MSEC_PER_SEC / HZ;
 }

 static int sysctl_k2u_int_conv_ms(bool *negp, ulong *u_ptr, const int *k_ptr)



best

Joel


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]