Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753876AbdHIROt (ORCPT ); Wed, 9 Aug 2017 13:14:49 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:38902 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752728AbdHIQyC (ORCPT ); Wed, 9 Aug 2017 12:54:02 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Matija Glavinic Pecotic , Thomas Gleixner , Alexander Sverdlin , khilman@baylibre.com, akpm@linux-foundation.org Subject: [PATCH 4.12 032/106] timers: Fix overflow in get_next_timer_interrupt Date: Wed, 9 Aug 2017 09:52:16 -0700 Message-Id: <20170809164520.654437350@linuxfoundation.org> X-Mailer: git-send-email 2.14.0 In-Reply-To: <20170809164515.714288642@linuxfoundation.org> References: <20170809164515.714288642@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1399 Lines: 39 4.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Matija Glavinic Pecotic commit 34f41c0316ed52b0b44542491d89278efdaa70e4 upstream. For e.g. HZ=100, timer being 430 jiffies in the future, and 32 bit unsigned int, there is an overflow on unsigned int right-hand side of the expression which results with wrong values being returned. Type cast the multiplier to 64bit to avoid that issue. Fixes: 46c8f0b077a8 ("timers: Fix get_next_timer_interrupt() computation") Signed-off-by: Matija Glavinic Pecotic Signed-off-by: Thomas Gleixner Reviewed-by: Alexander Sverdlin Cc: khilman@baylibre.com Cc: akpm@linux-foundation.org Link: http://lkml.kernel.org/r/a7900f04-2a21-c9fd-67be-ab334d459ee5@nokia.com Signed-off-by: Greg Kroah-Hartman --- kernel/time/timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/time/timer.c +++ b/kernel/time/timer.c @@ -1495,7 +1495,7 @@ u64 get_next_timer_interrupt(unsigned lo base->is_idle = false; } else { if (!is_max_delta) - expires = basem + (nextevt - basej) * TICK_NSEC; + expires = basem + (u64)(nextevt - basej) * TICK_NSEC; /* * If we expect to sleep more than a tick, mark the base idle: */