linux_dsm_epyc7002/kernel/time
John Stultz a4f8f6667f timekeeping: Cap array access in timekeeping_debug
It was reported that hibernation could fail on the 2nd attempt, where the
system hangs at hibernate() -> syscore_resume() -> i8237A_resume() ->
claim_dma_lock(), because the lock has already been taken.

However there is actually no other process would like to grab this lock on
that problematic platform.

Further investigation showed that the problem is triggered by setting
/sys/power/pm_trace to 1 before the 1st hibernation.

Since once pm_trace is enabled, the rtc becomes unmeaningful after suspend,
and meanwhile some BIOSes would like to adjust the 'invalid' RTC (e.g, smaller
than 1970) to the release date of that motherboard during POST stage, thus
after resumed, it may seem that the system had a significant long sleep time
which is a completely meaningless value.

Then in timekeeping_resume -> tk_debug_account_sleep_time, if the bit31 of the
sleep time happened to be set to 1, fls() returns 32 and we add 1 to
sleep_time_bin[32], which causes an out of bounds array access and therefor
memory being overwritten.

As depicted by System.map:
0xffffffff81c9d080 b sleep_time_bin
0xffffffff81c9d100 B dma_spin_lock
the dma_spin_lock.val is set to 1, which caused this problem.

This patch adds a sanity check in tk_debug_account_sleep_time()
to ensure we don't index past the sleep_time_bin array.

[jstultz: Problem diagnosed and original patch by Chen Yu, I've solved the
 issue slightly differently, but borrowed his excelent explanation of the
 issue here.]

Fixes: 5c83545f24 "power: Add option to log time spent in suspend"
Reported-by: Janek Kozicki <cosurgi@gmail.com>
Reported-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Cc: linux-pm@vger.kernel.org
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Xunlei Pang <xpang@redhat.com>
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
Cc: stable <stable@vger.kernel.org>
Cc: Zhang Rui <rui.zhang@intel.com>
Link: http://lkml.kernel.org/r/1471993702-29148-3-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2016-08-24 09:34:32 +02:00
..
alarmtimer.c alarmtimer: Fix comments describing structure fields 2016-06-20 12:47:09 -07:00
clockevents.c clockevents: Make clockevents_subsys static 2016-07-19 10:48:06 +02:00
clocksource.c clocksource: Make clocksource insert entry more efficient 2016-06-20 12:46:34 -07:00
hrtimer.c hrtimer: Convert to hotplug state machine 2016-07-15 10:41:37 +02:00
itimer.c itimers: Handle relative timers with CONFIG_TIME_LOW_RES proper 2016-01-17 11:13:55 +01:00
jiffies.c jiffies: Use CLOCKSOURCE_MASK instead of constant 2016-02-27 08:55:31 +01:00
Kconfig rcu: Drop RCU_USER_QS in favor of NO_HZ_FULL 2015-07-06 13:52:18 -07:00
Makefile time: Remove development rules from Kbuild/Makefile 2015-07-01 09:57:35 +02:00
ntp_internal.h ntp: Fix second_overflow's input parameter type to be 64bits 2015-12-16 16:50:56 -08:00
ntp.c ntp: Fix ADJ_SETOFFSET being used w/ ADJ_NANO 2016-01-22 12:01:42 +01:00
posix-clock.c posix-clock: Fix return code on the poll method's error path 2015-12-29 11:33:06 +01:00
posix-cpu-timers.c posix_cpu_timer: Exit early when process has been reaped 2016-07-11 17:20:12 +02:00
posix-timers.c posix-timers: Handle relative timers with CONFIG_TIME_LOW_RES proper 2016-01-17 11:13:55 +01:00
sched_clock.c timers, sched/clock: Clean up the code a bit 2015-03-27 08:34:01 +01:00
test_udelay.c time: Avoid timespec in udelay_test 2016-06-20 12:47:26 -07:00
tick-broadcast-hrtimer.c tick/broadcast-hrtimer: Set name of the ce_broadcast_hrtimer 2016-07-05 17:02:19 +02:00
tick-broadcast.c tick: Move the export of tick_broadcast_oneshot_control to the proper place 2015-07-14 12:01:04 +02:00
tick-common.c clockevents: Remove unused set_mode() callback 2015-09-14 11:00:55 +02:00
tick-internal.h timers: Forward the wheel clock whenever possible 2016-07-07 10:35:11 +02:00
tick-oneshot.c clockevents: Provide functions to set and get the state 2015-06-02 14:40:47 +02:00
tick-sched.c tick/nohz: Optimize nohz idle enter 2016-07-19 13:48:24 +02:00
tick-sched.h timers/nohz: Convert tick dependency mask to atomic_t 2016-03-29 11:52:11 +02:00
time.c time: remove timespec_add_safe() 2016-05-19 19:12:14 -07:00
timeconst.bc timeconst: Update path in comment 2015-10-26 10:06:06 +09:00
timeconv.c time: Add time64_to_tm() 2016-06-20 12:47:15 -07:00
timecounter.c timecounter: keep track of accumulated fractional nanoseconds 2014-12-30 18:29:27 -05:00
timekeeping_debug.c timekeeping: Cap array access in timekeeping_debug 2016-08-24 09:34:32 +02:00
timekeeping_internal.h clocksource: Make clocksource validation work for all clocksources 2015-12-19 15:59:57 +01:00
timekeeping.c timekeeping: Avoid taking lock in NMI path with CONFIG_DEBUG_TIMEKEEPING 2016-08-24 09:34:31 +02:00
timekeeping.h hrtimer: Make offset update smarter 2015-04-22 17:06:49 +02:00
timer_list.c hrtimer: Handle remaining time proper for TIME_LOW_RES 2016-01-17 11:13:55 +01:00
timer_stats.c timer: Avoid using timespec 2016-06-20 12:47:33 -07:00
timer.c timers: Fix get_next_timer_interrupt() computation 2016-08-09 09:31:55 +02:00