Commit 0e334db6 authored by Thomas Gleixner's avatar Thomas Gleixner Committed by Ingo Molnar

posix-timers: Fix division by zero bug

The signal delivery path of posix-timers can try to rearm the timer even if
the interval is zero. That's handled for the common case (hrtimer) but not
for alarm timers. In that case the forwarding function raises a division by
zero exception.

The handling for hrtimer based posix timers is wrong because it marks the
timer as active despite the fact that it is stopped.

Move the check from common_hrtimer_rearm() to posixtimer_rearm() to cure
both issues.

Reported-by: syzbot+9d38bedac9cc77b8ad5e@syzkaller.appspotmail.com
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: John Stultz <john.stultz@linaro.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: sboyd@kernel.org
Cc: stable@vger.kernel.org
Cc: syzkaller-bugs@googlegroups.com
Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1812171328050.1880@nanos.tec.linutronix.deSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 7566ec39
...@@ -289,9 +289,6 @@ static void common_hrtimer_rearm(struct k_itimer *timr) ...@@ -289,9 +289,6 @@ static void common_hrtimer_rearm(struct k_itimer *timr)
{ {
struct hrtimer *timer = &timr->it.real.timer; struct hrtimer *timer = &timr->it.real.timer;
if (!timr->it_interval)
return;
timr->it_overrun += hrtimer_forward(timer, timer->base->get_time(), timr->it_overrun += hrtimer_forward(timer, timer->base->get_time(),
timr->it_interval); timr->it_interval);
hrtimer_restart(timer); hrtimer_restart(timer);
...@@ -317,7 +314,7 @@ void posixtimer_rearm(struct kernel_siginfo *info) ...@@ -317,7 +314,7 @@ void posixtimer_rearm(struct kernel_siginfo *info)
if (!timr) if (!timr)
return; return;
if (timr->it_requeue_pending == info->si_sys_private) { if (timr->it_interval && timr->it_requeue_pending == info->si_sys_private) {
timr->kclock->timer_rearm(timr); timr->kclock->timer_rearm(timr);
timr->it_active = 1; timr->it_active = 1;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment