* [PATCH] watchdog: aspeed: fix integer overflow in set_timeout handler
@ 2021-04-16 0:12 rentao.bupt
2021-04-16 0:36 ` Joel Stanley
2021-04-16 0:50 ` Guenter Roeck
0 siblings, 2 replies; 5+ messages in thread
From: rentao.bupt @ 2021-04-16 0:12 UTC (permalink / raw)
To: Wim Van Sebroeck, Guenter Roeck, Joel Stanley, Andrew Jeffery,
linux-watchdog, linux-arm-kernel, linux-aspeed, linux-kernel,
openbmc, Tao Ren, Amithash Prasad
Cc: Tao Ren
From: Tao Ren <rentao.bupt@gmail.com>
Fix the time comparison (timeout vs. max_hw_heartbeat_ms) in set_timeout
handler to avoid potential integer overflow when the supplied timeout is
greater than aspeed's maximum allowed timeout (4294 seconds).
Fixes: efa859f7d786 ("watchdog: Add Aspeed watchdog driver")
Reported-by: Amithash Prasad <amithash@fb.com>
Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
---
drivers/watchdog/aspeed_wdt.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c
index 7e00960651fa..9f77272dc906 100644
--- a/drivers/watchdog/aspeed_wdt.c
+++ b/drivers/watchdog/aspeed_wdt.c
@@ -145,9 +145,8 @@ static int aspeed_wdt_set_timeout(struct watchdog_device *wdd,
struct aspeed_wdt *wdt = to_aspeed_wdt(wdd);
u32 actual;
- wdd->timeout = timeout;
-
- actual = min(timeout, wdd->max_hw_heartbeat_ms * 1000);
+ actual = min(timeout, wdd->max_hw_heartbeat_ms / 1000);
+ wdd->timeout = actual;
writel(actual * WDT_RATE_1MHZ, wdt->base + WDT_RELOAD_VALUE);
writel(WDT_RESTART_MAGIC, wdt->base + WDT_RESTART);
--
2.17.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] watchdog: aspeed: fix integer overflow in set_timeout handler
2021-04-16 0:12 [PATCH] watchdog: aspeed: fix integer overflow in set_timeout handler rentao.bupt
@ 2021-04-16 0:36 ` Joel Stanley
2021-04-16 0:50 ` Guenter Roeck
1 sibling, 0 replies; 5+ messages in thread
From: Joel Stanley @ 2021-04-16 0:36 UTC (permalink / raw)
To: Tao Ren
Cc: Wim Van Sebroeck, Guenter Roeck, Andrew Jeffery, LINUXWATCHDOG,
Linux ARM, linux-aspeed, Linux Kernel Mailing List,
OpenBMC Maillist, Tao Ren, Amithash Prasad
On Fri, 16 Apr 2021 at 00:12, <rentao.bupt@gmail.com> wrote:
>
> From: Tao Ren <rentao.bupt@gmail.com>
>
> Fix the time comparison (timeout vs. max_hw_heartbeat_ms) in set_timeout
> handler to avoid potential integer overflow when the supplied timeout is
> greater than aspeed's maximum allowed timeout (4294 seconds).
>
> Fixes: efa859f7d786 ("watchdog: Add Aspeed watchdog driver")
> Reported-by: Amithash Prasad <amithash@fb.com>
> Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
> ---
> drivers/watchdog/aspeed_wdt.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c
> index 7e00960651fa..9f77272dc906 100644
> --- a/drivers/watchdog/aspeed_wdt.c
> +++ b/drivers/watchdog/aspeed_wdt.c
> @@ -145,9 +145,8 @@ static int aspeed_wdt_set_timeout(struct watchdog_device *wdd,
> struct aspeed_wdt *wdt = to_aspeed_wdt(wdd);
> u32 actual;
>
> - wdd->timeout = timeout;
> -
> - actual = min(timeout, wdd->max_hw_heartbeat_ms * 1000);
> + actual = min(timeout, wdd->max_hw_heartbeat_ms / 1000);
The unit of timeout is seconds. You're comparing to ms/1000, which are
microseconds. I think the existing test is correct?
As far as integer overflow is concerned, max_hw_heartbeat_ms is an
unsigned int. We set it to 4294967, which *1000 = 0xfffffed8. This
should be fine.
> + wdd->timeout = actual;
This might be the correct thing to do though. I'll defer to the
watchdog maintainers for their input.
Cheers,
Joel
>
> writel(actual * WDT_RATE_1MHZ, wdt->base + WDT_RELOAD_VALUE);
> writel(WDT_RESTART_MAGIC, wdt->base + WDT_RESTART);
> --
> 2.17.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] watchdog: aspeed: fix integer overflow in set_timeout handler
2021-04-16 0:12 [PATCH] watchdog: aspeed: fix integer overflow in set_timeout handler rentao.bupt
2021-04-16 0:36 ` Joel Stanley
@ 2021-04-16 0:50 ` Guenter Roeck
2021-04-16 1:04 ` Tao Ren
1 sibling, 1 reply; 5+ messages in thread
From: Guenter Roeck @ 2021-04-16 0:50 UTC (permalink / raw)
To: rentao.bupt, Wim Van Sebroeck, Joel Stanley, Andrew Jeffery,
linux-watchdog, linux-arm-kernel, linux-aspeed, linux-kernel,
openbmc, Tao Ren, Amithash Prasad
On 4/15/21 5:12 PM, rentao.bupt@gmail.com wrote:
> From: Tao Ren <rentao.bupt@gmail.com>
>
> Fix the time comparison (timeout vs. max_hw_heartbeat_ms) in set_timeout
> handler to avoid potential integer overflow when the supplied timeout is
> greater than aspeed's maximum allowed timeout (4294 seconds).
>
> Fixes: efa859f7d786 ("watchdog: Add Aspeed watchdog driver")
> Reported-by: Amithash Prasad <amithash@fb.com>
> Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
> ---
> drivers/watchdog/aspeed_wdt.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c
> index 7e00960651fa..9f77272dc906 100644
> --- a/drivers/watchdog/aspeed_wdt.c
> +++ b/drivers/watchdog/aspeed_wdt.c
> @@ -145,9 +145,8 @@ static int aspeed_wdt_set_timeout(struct watchdog_device *wdd,
> struct aspeed_wdt *wdt = to_aspeed_wdt(wdd);
> u32 actual;
>
> - wdd->timeout = timeout;
> -
> - actual = min(timeout, wdd->max_hw_heartbeat_ms * 1000);
> + actual = min(timeout, wdd->max_hw_heartbeat_ms / 1000);
> + wdd->timeout = actual;
>
> writel(actual * WDT_RATE_1MHZ, wdt->base + WDT_RELOAD_VALUE);
> writel(WDT_RESTART_MAGIC, wdt->base + WDT_RESTART);
>
If the provided timeout is larger than the supported hardware timeout,
the watchdog core will ping the hardware on behalf of userspace.
The above code would defeat that mechanism for no good reason.
NACK.
Guenter
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] watchdog: aspeed: fix integer overflow in set_timeout handler
2021-04-16 0:50 ` Guenter Roeck
@ 2021-04-16 1:04 ` Tao Ren
2021-04-16 1:47 ` Guenter Roeck
0 siblings, 1 reply; 5+ messages in thread
From: Tao Ren @ 2021-04-16 1:04 UTC (permalink / raw)
To: Guenter Roeck
Cc: Wim Van Sebroeck, Joel Stanley, Andrew Jeffery, linux-watchdog,
linux-arm-kernel, linux-aspeed, linux-kernel, openbmc, Tao Ren,
Amithash Prasad
On Thu, Apr 15, 2021 at 05:50:32PM -0700, Guenter Roeck wrote:
> On 4/15/21 5:12 PM, rentao.bupt@gmail.com wrote:
> > From: Tao Ren <rentao.bupt@gmail.com>
> >
> > Fix the time comparison (timeout vs. max_hw_heartbeat_ms) in set_timeout
> > handler to avoid potential integer overflow when the supplied timeout is
> > greater than aspeed's maximum allowed timeout (4294 seconds).
> >
> > Fixes: efa859f7d786 ("watchdog: Add Aspeed watchdog driver")
> > Reported-by: Amithash Prasad <amithash@fb.com>
> > Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
> > ---
> > drivers/watchdog/aspeed_wdt.c | 5 ++---
> > 1 file changed, 2 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c
> > index 7e00960651fa..9f77272dc906 100644
> > --- a/drivers/watchdog/aspeed_wdt.c
> > +++ b/drivers/watchdog/aspeed_wdt.c
> > @@ -145,9 +145,8 @@ static int aspeed_wdt_set_timeout(struct watchdog_device *wdd,
> > struct aspeed_wdt *wdt = to_aspeed_wdt(wdd);
> > u32 actual;
> >
> > - wdd->timeout = timeout;
> > -
> > - actual = min(timeout, wdd->max_hw_heartbeat_ms * 1000);
> > + actual = min(timeout, wdd->max_hw_heartbeat_ms / 1000);
> > + wdd->timeout = actual;
> >
> > writel(actual * WDT_RATE_1MHZ, wdt->base + WDT_RELOAD_VALUE);
> > writel(WDT_RESTART_MAGIC, wdt->base + WDT_RESTART);
> >
>
> If the provided timeout is larger than the supported hardware timeout,
> the watchdog core will ping the hardware on behalf of userspace.
> The above code would defeat that mechanism for no good reason.
>
> NACK.
>
> Guenter
Thanks Guenter for Joel for the quick review!
The integer overflow happens at (actual * WDT_RATE_1MHZ). For example,
if a user tries to set timeout to 4295 seconds, then the hardware would
be programmed to timeout after about 32 milliseconds. I would say this
behavior is not expected?
Cheers,
Tao
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] watchdog: aspeed: fix integer overflow in set_timeout handler
2021-04-16 1:04 ` Tao Ren
@ 2021-04-16 1:47 ` Guenter Roeck
0 siblings, 0 replies; 5+ messages in thread
From: Guenter Roeck @ 2021-04-16 1:47 UTC (permalink / raw)
To: Tao Ren
Cc: Wim Van Sebroeck, Joel Stanley, Andrew Jeffery, linux-watchdog,
linux-arm-kernel, linux-aspeed, linux-kernel, openbmc, Tao Ren,
Amithash Prasad
On Thu, Apr 15, 2021 at 06:04:45PM -0700, Tao Ren wrote:
> On Thu, Apr 15, 2021 at 05:50:32PM -0700, Guenter Roeck wrote:
> > On 4/15/21 5:12 PM, rentao.bupt@gmail.com wrote:
> > > From: Tao Ren <rentao.bupt@gmail.com>
> > >
> > > Fix the time comparison (timeout vs. max_hw_heartbeat_ms) in set_timeout
> > > handler to avoid potential integer overflow when the supplied timeout is
> > > greater than aspeed's maximum allowed timeout (4294 seconds).
> > >
> > > Fixes: efa859f7d786 ("watchdog: Add Aspeed watchdog driver")
> > > Reported-by: Amithash Prasad <amithash@fb.com>
> > > Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
> > > ---
> > > drivers/watchdog/aspeed_wdt.c | 5 ++---
> > > 1 file changed, 2 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c
> > > index 7e00960651fa..9f77272dc906 100644
> > > --- a/drivers/watchdog/aspeed_wdt.c
> > > +++ b/drivers/watchdog/aspeed_wdt.c
> > > @@ -145,9 +145,8 @@ static int aspeed_wdt_set_timeout(struct watchdog_device *wdd,
> > > struct aspeed_wdt *wdt = to_aspeed_wdt(wdd);
> > > u32 actual;
> > >
> > > - wdd->timeout = timeout;
> > > -
> > > - actual = min(timeout, wdd->max_hw_heartbeat_ms * 1000);
> > > + actual = min(timeout, wdd->max_hw_heartbeat_ms / 1000);
> > > + wdd->timeout = actual;
> > >
> > > writel(actual * WDT_RATE_1MHZ, wdt->base + WDT_RELOAD_VALUE);
> > > writel(WDT_RESTART_MAGIC, wdt->base + WDT_RESTART);
> > >
> >
> > If the provided timeout is larger than the supported hardware timeout,
> > the watchdog core will ping the hardware on behalf of userspace.
> > The above code would defeat that mechanism for no good reason.
> >
> > NACK.
> >
> > Guenter
>
> Thanks Guenter for Joel for the quick review!
>
> The integer overflow happens at (actual * WDT_RATE_1MHZ). For example,
> if a user tries to set timeout to 4295 seconds, then the hardware would
> be programmed to timeout after about 32 milliseconds. I would say this
> behavior is not expected?
The fix would be
- actual = min(timeout, wdd->max_hw_heartbeat_ms * 1000);
+ actual = min(timeout, wdd->max_hw_heartbeat_ms / 1000);
without modifying
wdd->timeout = timeout;
The real problem here is that "wdd->max_hw_heartbeat_ms * 1000"
is simply wrong. The overflow is a side effect of the wrong
calculation, and concentrating on it disguises the real problem.
Guenter
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-04-16 1:47 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-16 0:12 [PATCH] watchdog: aspeed: fix integer overflow in set_timeout handler rentao.bupt
2021-04-16 0:36 ` Joel Stanley
2021-04-16 0:50 ` Guenter Roeck
2021-04-16 1:04 ` Tao Ren
2021-04-16 1:47 ` Guenter Roeck
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).