Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Jiasheng Jiang <jiasheng@iscas.ac.cn>
To:     john.stultz@linaro.org, tglx@linutronix.de, sboyd@kernel.org
Cc:     linux-kernel@vger.kernel.org, Jiasheng Jiang <jiasheng@iscas.ac.cn>
Subject: [PATCH] clocksource: Fix implicit type conversion
Date:   Wed, 27 Oct 2021 07:48:19 +0000
Message-Id: <1635320899-2742957-1-git-send-email-jiasheng@iscas.ac.cn>
Precedence: bulk

As the type of 'next_cpu' is int, its value is range from (-2^31)
to (2^31 - 1).
But the return type of cpumask_next() is unsigned int, whose value
is range from 0 to (2^32 - 1).
Suppose that the return value of cpumask_next() is (2^31), as it is
impicitly casted to int, the actual value of 'next_cpu' is (-2^31).
Also since the type of 'nr_cpu_ids' is unsigned int, we suppose the
value of 'nr_cpu_ids' is (2^32 - 1).
Therefore, the restriction 'next_cpu >= nr_cpu_ids' isn't statisfied
because 'next_cpu' is impicitly casted to unsigned int, whose value
is (2^31).
As a result, the value of 'next_cpu' in add_timer_on() is (-2^31)
that is obviouly illegal and dangerous.
To avoid the risk, it might be better to add the check which can
prevent the illegal input for add_timer_on().

Fixes: 5db0e1e ("cpumask: replace for_each_cpu_mask_nr with for_each_cpu in kernel/time/")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
---
 kernel/time/clocksource.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 2cd9025..6237f18 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -291,7 +291,7 @@ static void clocksource_watchdog(struct timer_list *unused)
 	 * to each other.
 	 */
 	next_cpu = cpumask_next(raw_smp_processor_id(), cpu_online_mask);
-	if (next_cpu >= nr_cpu_ids)
+	if (next_cpu < 0 || next_cpu >= nr_cpu_ids)
 		next_cpu = cpumask_first(cpu_online_mask);
 
 	/*
-- 
2.7.4