diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2007-02-16 01:28:12 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-02-16 08:13:59 -0800 |
| commit | 8bfd9a7a229b5f3d3eda5d7d45c2eebec5b4ba16 (patch) | |
| tree | 01c910a659f387b921493cab9bd4decd8fa66a4e /kernel/itimer.c | |
| parent | 54cdfdb47f73b5af3d1ebb0f1e383efbe70fde9e (diff) | |
| download | linux-8bfd9a7a229b5f3d3eda5d7d45c2eebec5b4ba16.tar.gz linux-8bfd9a7a229b5f3d3eda5d7d45c2eebec5b4ba16.tar.bz2 linux-8bfd9a7a229b5f3d3eda5d7d45c2eebec5b4ba16.zip | |
[PATCH] hrtimers: prevent possible itimer DoS
Fix potential setitimer DoS with high-res timers by pushing itimer rearm
processing to process context.
[Fixes from: Ingo Molnar <mingo@elte.hu>]
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Cc: john stultz <johnstul@us.ibm.com>
Cc: Roman Zippel <zippel@linux-m68k.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel/itimer.c')
| -rw-r--r-- | kernel/itimer.c | 14 |
1 files changed, 6 insertions, 8 deletions
diff --git a/kernel/itimer.c b/kernel/itimer.c index 4fc6c0caf5d4..307c6a632ef6 100644 --- a/kernel/itimer.c +++ b/kernel/itimer.c @@ -135,11 +135,6 @@ enum hrtimer_restart it_real_fn(struct hrtimer *timer) send_group_sig_info(SIGALRM, SEND_SIG_PRIV, sig->tsk); - if (sig->it_real_incr.tv64 != 0) { - hrtimer_forward(timer, hrtimer_cb_get_time(timer), - sig->it_real_incr); - return HRTIMER_RESTART; - } return HRTIMER_NORESTART; } @@ -231,11 +226,14 @@ again: spin_unlock_irq(&tsk->sighand->siglock); goto again; } - tsk->signal->it_real_incr = - timeval_to_ktime(value->it_interval); expires = timeval_to_ktime(value->it_value); - if (expires.tv64 != 0) + if (expires.tv64 != 0) { + tsk->signal->it_real_incr = + timeval_to_ktime(value->it_interval); hrtimer_start(timer, expires, HRTIMER_MODE_REL); + } else + tsk->signal->it_real_incr.tv64 = 0; + spin_unlock_irq(&tsk->sighand->siglock); break; case ITIMER_VIRTUAL: |