From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Jackson Subject: Re: [PATCH 2/2] libxl: fix stale timeout event callback race Date: Wed, 12 Dec 2012 17:16:04 +0000 Message-ID: <20680.48084.559983.299246@mariner.uk.xensource.com> References: <20678.5159.946248.90947@mariner.uk.xensource.com> <1355158624-11163-2-git-send-email-ian.jackson@eu.citrix.com> <50C7B974.4050706@suse.com> <20680.47971.962603.851882@mariner.uk.xensource.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20680.47971.962603.851882@mariner.uk.xensource.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Jim Fehlig , "xen-devel@lists.xen.org" , Ian Campbell , Bamvor Jian Zhang List-Id: xen-devel@lists.xenproject.org Ian Jackson writes ("Re: [Xen-devel] [PATCH 2/2] libxl: fix stale timeout event callback race"): > Jim Fehlig writes ("Re: [Xen-devel] [PATCH 2/2] libxl: fix stale timeout event callback race"): > > - gettimeofday(&now, NULL); > > - timeout = (abs_t.tv_usec - now.tv_usec) / 1000; > > - timeout += (abs_t.tv_sec - now.tv_sec) * 1000; > > Specifically, this code has an integer arithmetic overflow. If you look at beforepoll_internal in libxl_event.c, near line 859, you can see how I tackled this same problem there. Ian.