John Stultz a4f8f6667f timekeeping: Cap array access in timekeeping_debug ... It was reported that hibernation could fail on the 2nd attempt, where the system hangs at hibernate() -> syscore_resume() -> i8237A_resume() -> claim_dma_lock(), because the lock has already been taken. However there is actually no other process would like to grab this lock on that problematic platform. Further investigation showed that the problem is triggered by setting /sys/power/pm_trace to 1 before the 1st hibernation. Since once pm_trace is enabled, the rtc becomes unmeaningful after suspend, and meanwhile some BIOSes would like to adjust the 'invalid' RTC (e.g, smaller than 1970) to the release date of that motherboard during POST stage, thus after resumed, it may seem that the system had a significant long sleep time which is a completely meaningless value. Then in timekeeping_resume -> tk_debug_account_sleep_time, if the bit31 of the sleep time happened to be set to 1, fls() returns 32 and we add 1 to sleep_time_bin[32], which causes an out of bounds array access and therefor memory being overwritten. As depicted by System.map: 0xffffffff81c9d080 b sleep_time_bin 0xffffffff81c9d100 B dma_spin_lock the dma_spin_lock.val is set to 1, which caused this problem. This patch adds a sanity check in tk_debug_account_sleep_time() to ensure we don't index past the sleep_time_bin array. [jstultz: Problem diagnosed and original patch by Chen Yu, I've solved the issue slightly differently, but borrowed his excelent explanation of the issue here.] Fixes: 5c83545f24 "power: Add option to log time spent in suspend" Reported-by: Janek Kozicki <cosurgi@gmail.com> Reported-by: Chen Yu <yu.c.chen@intel.com> Signed-off-by: John Stultz <john.stultz@linaro.org> Cc: linux-pm@vger.kernel.org Cc: Peter Zijlstra <peterz@infradead.org> Cc: Xunlei Pang <xpang@redhat.com> Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net> Cc: stable <stable@vger.kernel.org> Cc: Zhang Rui <rui.zhang@intel.com> Link: http://lkml.kernel.org/r/1471993702-29148-3-git-send-email-john.stultz@linaro.org Signed-off-by: Thomas Gleixner <tglx@linutronix.de>		2016-08-24 09:34:32 +02:00
..
alarmtimer.c	alarmtimer: Fix comments describing structure fields	2016-06-20 12:47:09 -07:00
clockevents.c	clockevents: Make clockevents_subsys static	2016-07-19 10:48:06 +02:00
clocksource.c	clocksource: Make clocksource insert entry more efficient	2016-06-20 12:46:34 -07:00
hrtimer.c	hrtimer: Convert to hotplug state machine	2016-07-15 10:41:37 +02:00
itimer.c
jiffies.c
Kconfig
Makefile
ntp_internal.h
ntp.c
posix-clock.c
posix-cpu-timers.c	posix_cpu_timer: Exit early when process has been reaped	2016-07-11 17:20:12 +02:00
posix-timers.c
sched_clock.c
test_udelay.c	time: Avoid timespec in udelay_test	2016-06-20 12:47:26 -07:00
tick-broadcast-hrtimer.c	tick/broadcast-hrtimer: Set name of the ce_broadcast_hrtimer	2016-07-05 17:02:19 +02:00
tick-broadcast.c
tick-common.c
tick-internal.h	timers: Forward the wheel clock whenever possible	2016-07-07 10:35:11 +02:00
tick-oneshot.c
tick-sched.c	tick/nohz: Optimize nohz idle enter	2016-07-19 13:48:24 +02:00
tick-sched.h	timers/nohz: Convert tick dependency mask to atomic_t	2016-03-29 11:52:11 +02:00
time.c	time: remove timespec_add_safe()	2016-05-19 19:12:14 -07:00
timeconst.bc
timeconv.c	time: Add time64_to_tm()	2016-06-20 12:47:15 -07:00
timecounter.c
timekeeping_debug.c	timekeeping: Cap array access in timekeeping_debug	2016-08-24 09:34:32 +02:00
timekeeping_internal.h
timekeeping.c	timekeeping: Avoid taking lock in NMI path with CONFIG_DEBUG_TIMEKEEPING	2016-08-24 09:34:31 +02:00
timekeeping.h
timer_list.c
timer_stats.c	timer: Avoid using timespec	2016-06-20 12:47:33 -07:00
timer.c	timers: Fix get_next_timer_interrupt() computation	2016-08-09 09:31:55 +02:00