Received-SPF: pass (google.com: domain of linux-kernel+bounces-5187-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Received-SPF: Pass (protection.outlook.com: domain of elektrobit.com
 designates 4.79.107.243 as permitted sender) receiver=protection.outlook.com;
 client-ip=4.79.107.243; helo=usbth1es003.ebgroup.elektrobit.com; pr=C
Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
 elektrobit.com discourages use of 213.95.148.172 as permitted sender)
From: Simone Weiss <simone.weiss@elektrobit.com>
To: <tglx@linutronix.de>
CC: <simone.weiss@elektrobit.com>, <linux-kernel@vger.kernel.org>
Subject: [PATCH] Fix UBSAN warning for subtracting ktime_t
Date: Tue, 19 Dec 2023 13:44:34 +0100
Message-ID: <20231219124434.870613-1-simone.weiss@elektrobit.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
X-Microsoft-Antispam-Message-Info-Original:
 Gk7kr28i/kYgIOglWiG3NTIbZD7rPf6dKRN56kYIp4PBBCMvo9gw41YE720GrnK6XNA66ZI6Wwtj2fQqfnSHeHIIqj673rKI5eArT+xv0XX3tgFZUo+kkTlLyRAgSqrw1Iq3VQgcZeNSFo1n59NJ5oKEB0XxAdUwuP2YERxQIJy2bbjzDBM6up7b56kWhABtFPiFeQc+CrmzXY9yrnIiMk3WtOyg+4H99BSVox2U7HXiqIhGRrI4viX4bo704YkvOvvSK0HUIiSknb45YpuKDVwGpIXGqEFavv8yJaDMQu1JClRhEE1AR9wTBIwT2G9JtbfjtrsLuNoCrSNw6HJHqJWNdtEiWnwbNgi1MuyfOQrAVoF/EQyOGik2osR8s8z8j5ZUa4P2JdKRXu+CWiXZ75GglhdJSlVzfjvFU4anBki+6VQHhb8Ri6ZgWh0wJ8xtOCS2V7MX2hRnL3gcwCVHH6QurtxTchopZhOnnDG/xM9awJw6qIbNTXo6o+FPndk3z38ixsmYCgxWnjQLru54po8mYEN+lwhni5XCP1B1S2RsBmvnJQvGVeTY1+ZvLRKPiM33U06fQirO/KEJClWZ0fh1g6u7baZfEb9CuIkzex8KO6AdLz0xOpI5Vo/Nfx9m1H03kSRTj6FdtC34Tp8weVuk+imGm0za7UXCHOOxUwoTobdBUG1MHpHC27/Qydr8FwxoEBKWk732S6wcQjreZ0a5suR4VMeHd04FSUfFSQ4=
X-Forefront-Antispam-Report-Untrusted:
 CIP:213.95.148.172;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:denue6es013.ebgroup.elektrobit.com;PTR:eth1-fw1-nbg6.eb.noris.de;CAT:NONE;SFS:(13230031)(4636009)(396003)(39860400002)(346002)(136003)(376002)(230922051799003)(82310400011)(64100799003)(186009)(451199024)(1800799012)(46966006)(36840700001)(40470700004)(40480700001)(86362001)(81166007)(356005)(36756003)(82740400003)(40460700003)(426003)(7696005)(6666004)(478600001)(41300700001)(54906003)(6916009)(70206006)(70586007)(1076003)(336012)(26005)(2616005)(47076005)(83380400001)(2906002)(966005)(5660300002)(36860700001)(44832011)(316002)(8936002)(8676002)(4326008);DIR:OUT;SFP:1101;
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO3PR08MB8006
X-SM-smarthost: [elektrobit-com.mail.protection.outlook.com]
X-MS-Exchange-Transport-CrossTenantHeadersStripped:
 BN8NAM12FT009.eop-nam12.prod.protection.outlook.com
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id-Prvs:
	4fd4cbe5-3d65-4e05-12b7-08dc00904558
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
	ZJkJGNQEW203rIkqAxgAabL+2Rx4qnQCAGS4Llp/BnW4alsJ5D7y8jWfNL2dQgtVYEOI/tCGkKiZYZbq8xdrjWEyX2XA2XEQ3uda3OJCdJvkeRWegrYMlimKoLCJga67bMaZfhOjLh1TMmGnHSKuhU0SmpM7NG9BpwM9t4U5zi1ZaRIck0xQKDTFhgs4yLj9YQZplWOCYcweSN6WpfZKy+aXw9xiwehcIHaBxEy93BDlWeIkl+mZwItbfkwEjkkUDlUcHdVJNPCnlKjaU2yV512h2lK5q/g+9Dl+0zaOggi4GtdzmXI7lYLqYMZMU1zBV6xjdmtkHLMsJEg3GoO9MJpOZLCrExhf56qc0rbO5m0RUMvUjO2cKk6bvA5b1lx1NSgs4b7oMeXbxENkkZQG01x74vmdyDPDXtinZLqR9iQygblllrSN7v0VAOfH7pp8xmYFDfp0uwXHEie9ESKRKSkV3RyENRx9BvILNwXdpFo33OvSyZ6LGPCovyq+X80R7vGFdzRgN4dL1vR35YMUxyn7ZqkflaJIwuohCl0685j7ZgWgyRw1JSbfn+Eo8lnfW7A4CQJLGnZ46n/XvwE+J0CGGSPdmGcUXt5gEDv8WlRLBxl1+MS6bewZgvgYJXwAoxC3LuiXtvlSMxJu5Sm9v4Buqhy0V62n/yKsCc46e4yg0aLfYUsk9PQiSzwg8c6b6M4kR9zaslcLtyxQpmhP4enJflUZAG7N3+gjz9tND3g=
X-Forefront-Antispam-Report:
	CIP:4.79.107.243;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:usbth1es003.ebgroup.elektrobit.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230031)(4636009)(396003)(39850400004)(376002)(346002)(136003)(230922051799003)(82310400011)(1800799012)(186009)(451199024)(64100799003)(36840700001)(46966006)(83380400001)(2616005)(6916009)(478600001)(316002)(54906003)(26005)(40480700001)(966005)(6666004)(70586007)(336012)(1076003)(426003)(8936002)(4326008)(47076005)(44832011)(8676002)(7696005)(70206006)(36860700001)(5660300002)(2906002)(86362001)(36756003)(82740400003)(81166007)(41300700001)(36900700001);DIR:OUT;SFP:1101;
X-OriginatorOrg: elektrobit.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Dec 2023 12:44:45.5812
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 4d1c8518-11ef-4b96-097a-08dc009047d0
X-MS-Exchange-CrossTenant-Id: e764c36b-012e-4216-910d-8fd16283182d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e764c36b-012e-4216-910d-8fd16283182d;Ip=[4.79.107.243];Helo=[usbth1es003.ebgroup.elektrobit.com]
X-MS-Exchange-CrossTenant-AuthSource:
	BN8NAM12FT009.eop-nam12.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM3PR08MB8962

This issue was found with syzkaller.

UBSAN: Undefined behaviour in kernel/time/hrtimer.c:612:10
signed integer overflow:
9223372036854775807 - -51224496 cannot be represented in type
'long long int'

To fix this issue, add and use a function to check for overflows when
substracting two ktime_t values. This is largly the solution already once
submitted once as RFC. See Link below.
Link: https://lore.kernel.org/lkml/20190306131326.10275-1-yaohongbo@huawei.com/

Signed-off-by: Simone Weiss <simone.weiss@elektrobit.com>
---
 include/linux/ktime.h |  7 +++++++
 kernel/time/hrtimer.c | 22 +++++++++++++++++++---
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/include/linux/ktime.h b/include/linux/ktime.h
index 73f20deb497d..ed90f53741f4 100644
--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -55,6 +55,12 @@ static inline ktime_t ktime_set(const s64 secs, const unsigned long nsecs)
  */
 #define ktime_add_unsafe(lhs, rhs)	((u64) (lhs) + (rhs))
 
+/*
+ * Same as ktime_sub(), but avoids undefined behaviour on overflow; however,
+ * this means that you must check the result for overflow yourself.
+ */
+#define ktime_sub_unsafe(lhs, rhs)	((u64) (lhs) - (rhs))
+
 /*
  * Add a ktime_t variable and a scalar nanosecond value.
  * res = kt + nsval:
@@ -197,6 +203,7 @@ static inline ktime_t ktime_sub_ms(const ktime_t kt, const u64 msec)
 }
 
 extern ktime_t ktime_add_safe(const ktime_t lhs, const ktime_t rhs);
+extern ktime_t ktime_sub_safe(const ktime_t lhs, const ktime_t rhs);
 
 /**
  * ktime_to_timespec64_cond - convert a ktime_t variable to timespec64
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index 760793998cdd..cd0534bb60a8 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -195,7 +195,7 @@ hrtimer_check_target(struct hrtimer *timer, struct hrtimer_clock_base *new_base)
 {
 	ktime_t expires;
 
-	expires = ktime_sub(hrtimer_get_expires(timer), new_base->offset);
+	expires = ktime_sub_safe(hrtimer_get_expires(timer), new_base->offset);
 	return expires < new_base->cpu_base->expires_next;
 }
 
@@ -342,6 +342,22 @@ ktime_t ktime_add_safe(const ktime_t lhs, const ktime_t rhs)
 
 EXPORT_SYMBOL_GPL(ktime_add_safe);
 
+/*
+ * Sub two ktime values and do a safety check for overflow:
+ */
+ktime_t ktime_sub_safe(const ktime_t lhs, const ktime_t rhs)
+{
+	ktime_t res = ktime_sub_unsafe(lhs, rhs);
+
+	if (lhs > 0 && rhs < 0 && res < 0)
+		res = ktime_set(KTIME_SEC_MAX, 0);
+	else if (lhs < 0 && rhs > 0 && res > 0)
+		res = ktime_set(-KTIME_SEC_MAX, 0);
+
+	return res;
+}
+EXPORT_SYMBOL_GPL(ktime_sub_safe);
+
 #ifdef CONFIG_DEBUG_OBJECTS_TIMERS
 
 static const struct debug_obj_descr hrtimer_debug_descr;
@@ -523,7 +539,7 @@ static ktime_t __hrtimer_next_event_base(struct hrtimer_cpu_base *cpu_base,
 
 			timer = container_of(next, struct hrtimer, node);
 		}
-		expires = ktime_sub(hrtimer_get_expires(timer), base->offset);
+		expires = ktime_sub_safe(hrtimer_get_expires(timer), base->offset);
 		if (expires < expires_next) {
 			expires_next = expires;
 
@@ -811,7 +827,7 @@ static void hrtimer_reprogram(struct hrtimer *timer, bool reprogram)
 {
 	struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases);
 	struct hrtimer_clock_base *base = timer->base;
-	ktime_t expires = ktime_sub(hrtimer_get_expires(timer), base->offset);
+	ktime_t expires = ktime_sub_safe(hrtimer_get_expires(timer), base->offset);
 
 	WARN_ON_ONCE(hrtimer_get_expires_tv64(timer) < 0);
 
-- 
2.34.1