[3.13.y.z extended stable] Patch "timer: Prevent overflow in apply_slack" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    timer: Prevent overflow in apply_slack

to the linux-3.13.y-queue branch of the 3.13.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.13.y-queue

This patch is scheduled to be released in version 3.13.11.3.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.13.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From e3565e1aa84b7986379e379d63f780ce8c971a10 Mon Sep 17 00:00:00 2001
From: Jiri Bohac <jbohac at suse.cz>
Date: Fri, 18 Apr 2014 17:23:11 +0200
Subject: timer: Prevent overflow in apply_slack

commit 98a01e779f3c66b0b11cd7e64d531c0e41c95762 upstream.

On architectures with sizeof(int) < sizeof (long), the
computation of mask inside apply_slack() can be undefined if the
computed bit is > 32.

E.g. with: expires = 0xffffe6f5 and slack = 25, we get:

expires_limit = 0x20000000e
bit = 33
mask = (1 << 33) - 1  /* undefined */

On x86, mask becomes 1 and and the slack is not applied properly.
On s390, mask is -1, expires is set to 0 and the timer fires immediately.

Use 1UL << bit to solve that issue.

Suggested-by: Deborah Townsend <dstownse at us.ibm.com>
Signed-off-by: Jiri Bohac <jbohac at suse.cz>
Link: http://lkml.kernel.org/r/20140418152310.GA13654@midget.suse.cz
Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 kernel/timer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/timer.c b/kernel/timer.c
index accfd24..38f0d40 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -822,7 +822,7 @@ unsigned long apply_slack(struct timer_list *timer, unsigned long expires)

 	bit = find_last_bit(&mask, BITS_PER_LONG);

-	mask = (1 << bit) - 1;
+	mask = (1UL << bit) - 1;

 	expires_limit = expires_limit & ~(mask);

--
1.9.1