Skip to content

Potential integer overflow in timer tick handling #61

@HeatCrab

Description

@HeatCrab

During the review of PR #59, potential wrap-around issues were identified in kernel/timer.c.

The current implementation uses direct comparison for timer deadlines:

void _timer_tick_handler(void)
{
	// omitted

        if (now >= t->deadline_ticks) {
            expired_timers[expired_count++] = t;
            kcb->timer_list->head->next = node->next;
            kcb->timer_list->length--;
            return_timer_node(node);
	
	// omitted
}

And for Sorting timers:

/* Sorted insert with early termination for common cases */
static int32_t timer_sorted_insert(timer_t *timer)
{
    // omitted
	
    /* Find insertion point */
    while (prev->next != kcb->timer_list->tail) {
        timer_t *current_timer = (timer_t *) prev->next->data;
        if (timer->deadline_ticks < current_timer->deadline_ticks)
            break;
        prev = prev->next;
    }

    // omitted
}

When the system tick counter (mo_ticks()) wraps around:

  1. A timer set for a future time (small value after wrap) might be interpreted as expired immediately if compared against a large now value before the wrap.
  2. A timer set for a distant future (large value) might be ignored if now has wrapped to a small value.
  3. The timer_sorted_insert logic will incorrectly order timers that span across the wrap-around point.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions