Skip to content

Commit

Permalink
sched: fix divide by zero at {thread_group,task}_times
Browse files Browse the repository at this point in the history
On architectures where cputime_t is 64 bit type, is possible to trigger
divide by zero on do_div(temp, (__force u32) total) line, if total is a
non zero number but has lower 32 bit's zeroed. Removing casting is not
a good solution since some do_div() implementations do cast to u32
internally.

This problem can be triggered in practice on very long lived processes:

  PID: 2331   TASK: ffff880472814b00  CPU: 2   COMMAND: "oraagent.bin"
   #0 [ffff880472a51b70] machine_kexec at ffffffff8103214b
   franciscofranco#1 [ffff880472a51bd0] crash_kexec at ffffffff810b91c2
   franciscofranco#2 [ffff880472a51ca0] oops_end at ffffffff814f0b00
   franciscofranco#3 [ffff880472a51cd0] die at ffffffff8100f26b
   franciscofranco#4 [ffff880472a51d00] do_trap at ffffffff814f03f4
   franciscofranco#5 [ffff880472a51d60] do_divide_error at ffffffff8100cfff
   franciscofranco#6 [ffff880472a51e00] divide_error at ffffffff8100be7b
      [exception RIP: thread_group_times+0x56]
      RIP: ffffffff81056a16  RSP: ffff880472a51eb8  RFLAGS: 00010046
      RAX: bc3572c9fe12d194  RBX: ffff880874150800  RCX: 0000000110266fad
      RDX: 0000000000000000  RSI: ffff880472a51eb8  RDI: 001038ae7d9633dc
      RBP: ffff880472a51ef8   R8: 00000000b10a3a64   R9: ffff880874150800
      R10: 00007fcba27ab680  R11: 0000000000000202  R12: ffff880472a51f08
      R13: ffff880472a51f10  R14: 0000000000000000  R15: 0000000000000007
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   franciscofranco#7 [ffff880472a51f00] do_sys_times at ffffffff8108845d
   franciscofranco#8 [ffff880472a51f40] sys_times at ffffffff81088524
   #9 [ffff880472a51f80] system_call_fastpath at ffffffff8100b0f2
      RIP: 0000003808caac3a  RSP: 00007fcba27ab6d8  RFLAGS: 00000202
      RAX: 0000000000000064  RBX: ffffffff8100b0f2  RCX: 0000000000000000
      RDX: 00007fcba27ab6e0  RSI: 000000000076d58e  RDI: 00007fcba27ab6e0
      RBP: 00007fcba27ab700   R8: 0000000000000020   R9: 000000000000091b
      R10: 00007fcba27ab680  R11: 0000000000000202  R12: 00007fff9ca41940
      R13: 0000000000000000  R14: 00007fcba27ac9c0  R15: 00007fff9ca41940
      ORIG_RAX: 0000000000000064  CS: 0033  SS: 002b

Cc: [email protected]
Signed-off-by: Stanislaw Gruszka <[email protected]>
Signed-off-by: Peter Zijlstra <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Thomas Gleixner <[email protected]>
  • Loading branch information
Stanislaw Gruszka authored and raden committed Mar 2, 2014
1 parent 71a6e32 commit 16c3945
Showing 1 changed file with 20 additions and 14 deletions.
34 changes: 20 additions & 14 deletions kernel/sched/core.c
Original file line number Diff line number Diff line change
Expand Up @@ -3173,6 +3173,20 @@ void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
# define nsecs_to_cputime(__nsecs) nsecs_to_jiffies(__nsecs)
#endif

static cputime_t scale_utime(cputime_t utime, cputime_t rtime, cputime_t total)
{
u64 temp = (__force u64) rtime;

temp *= (__force u64) utime;

if (sizeof(cputime_t) == 4)
temp = div_u64(temp, (__force u32) total);
else
temp = div64_u64(temp, (__force u64) total);

return (__force cputime_t) temp;
}

void task_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
{
cputime_t rtime, utime = p->utime, total = utime + p->stime;
Expand All @@ -3182,13 +3196,9 @@ void task_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
*/
rtime = nsecs_to_cputime(p->se.sum_exec_runtime);

if (total) {
u64 temp = (__force u64) rtime;

temp *= (__force u64) utime;
do_div(temp, (__force u32) total);
utime = (__force cputime_t) temp;
} else
if (total)
utime = scale_utime(utime, rtime, total);
else
utime = rtime;

/*
Expand All @@ -3215,13 +3225,9 @@ void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
total = cputime.utime + cputime.stime;
rtime = nsecs_to_cputime(cputime.sum_exec_runtime);

if (total) {
u64 temp = (__force u64) rtime;

temp *= (__force u64) cputime.utime;
do_div(temp, (__force u32) total);
utime = (__force cputime_t) temp;
} else
if (total)
utime = scale_utime(cputime.utime, rtime, total);
else
utime = rtime;

sig->prev_utime = max(sig->prev_utime, utime);
Expand Down

0 comments on commit 16c3945

Please sign in to comment.