[patch 18/28] x86: HPET fix moronic 32/64bit thinko

!MAILaRCHIVE_VOTE_RePLACE
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
To: <linux-kernel@...>, <stable@...>
Cc: Justin Forbes <jmforbes@...>, Zwane Mwaikambo <zwane@...>, Theodore Ts'o <tytso@...>, Randy Dunlap <rdunlap@...>, Dave Jones <davej@...>, Chuck Wolber <chuckw@...>, Chris Wedgwood <reviews@...>, Michael Krufky <mkrufky@...>, Chuck Ebbert <cebbert@...>, Domenico Andreoli <cavokz@...>, Willy Tarreau <w@...>, Rodrigo Rubira Branco <rbranco@...>, Jake Edge <jake@...>, Eugene Teo <eteo@...>, <torvalds@...>, <akpm@...>, <alan@...>, Thomas Gleixner <tglx@...>
Date: Monday, October 6, 2008 - 7:17 pm

2.6.25-stable review patch.  If anyone has any objections, please let us
know.

------------------
From: Thomas Gleixner <tglx@linutronix.de>

commit f7676254f179eac6b5244a80195ec8ae0e9d4606 upstream

We use the HPET only in 32bit mode because:
1) some HPETs are 32bit only
2) on i386 there is no way to read/write the HPET atomic 64bit wide

The HPET code unification done by the "moron of the year" did
not take into account that unsigned long is different on 32 and
64 bit.

This thinko results in a possible endless loop in the clockevents
code, when the return comparison fails due to the 64bit/332bit
unawareness.

unsigned long cnt = (u32) hpet_read() + delta can wrap over 32bit.
but the final compare will fail and return -ETIME causing endless
loops.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/x86/kernel/hpet.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -282,15 +282,15 @@ static void hpet_legacy_set_mode(enum cl
 }
 
 static int hpet_legacy_next_event(unsigned long delta,
-			   struct clock_event_device *evt)
+				  struct clock_event_device *evt)
 {
-	unsigned long cnt;
+	u32 cnt;
 
 	cnt = hpet_readl(HPET_COUNTER);
-	cnt += delta;
+	cnt += (u32) delta;
 	hpet_writel(cnt, HPET_T0_CMP);
 
-	return ((long)(hpet_readl(HPET_COUNTER) - cnt ) > 0) ? -ETIME : 0;
+	return (s32)((u32)hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0;
 }
 
 /*

-- 
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
[patch 00/28] 2.6.25-stable review, Greg KH, (Mon Oct 6, 7:16 pm)
[patch 28/28] udp: Fix rcv socket locking, Greg KH, (Mon Oct 6, 7:18 pm)
[patch 24/28] niu: panic on reset, Greg KH, (Mon Oct 6, 7:17 pm)
[patch 18/28] x86: HPET fix moronic 32/64bit thinko, Greg KH, (Mon Oct 6, 7:17 pm)
[patch 09/28] rtc: fix deadlock, Greg KH, (Mon Oct 6, 7:17 pm)
[patch 07/28] ACPI: Fix thermal shutdowns, Greg KH, (Mon Oct 6, 7:17 pm)
[patch 03/28] pxa2xx_spi: chipselect bugfixes, Greg KH, (Mon Oct 6, 7:17 pm)
[patch 02/28] pxa2xx_spi: dma bugfixes, Greg KH, (Mon Oct 6, 7:17 pm)
Re: [patch 02/28] pxa2xx_spi: dma bugfixes, Ned Forrester, (Mon Oct 6, 8:15 pm)
[patch 01/28] USB: fix hcd interrupt disabling, Greg KH, (Mon Oct 6, 7:16 pm)