Bug 94238

Summary: 32 bit overflow prevents proper setting of base in tc_cpu_ticks()
Product: Base System Reporter: Tim Kuik <tkuik>
Component: kernAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: Unspecified   
Hardware: Any   
OS: Any   

Description Tim Kuik 2006-03-08 19:50:09 UTC 
in kern_tc.c: tc_cpu_ticks(), the line
base += tc->tc_counter_mask + 1;
will cause a 32 bit overflow if the tc_counter_mask is 0xffffffff, resulting in base not being incremented.

Fix: 

Change the line to:
base += (uint64_t)(tc->tc_counter_mask) + 1;
How-To-Repeat: As long as the mask is set to 0xffffffff, it will always happen.
Comment 1 Poul-Henning Kamp 2006-03-08 19:56:30 UTC 
Already done.

In message <200603081944.k28JiQGr006673@www.freebsd.org>, Tim Kuik writes:
>
>>Number:         94238
>>Category:       kern
>>Synopsis:       32 bit overflow prevents proper setting of base in tc_cpu_ticks()
>>Confidential:   no
>>Severity:       serious
>>Priority:       low
>>Responsible:    freebsd-bugs
>>State:          open
>>Quarter:        
>>Keywords:       
>>Date-Required:
>>Class:          sw-bug
>>Submitter-Id:   current-users
>>Arrival-Date:   Wed Mar 08 19:50:09 GMT 2006
>>Closed-Date:
>>Last-Modified:
>>Originator:     Tim Kuik
>>Release:        current
>>Organization:
>Cisco
>>Environment:
>FreeBSD tkuik-freebsd.cisco 7.0-CURRENT FreeBSD 7.0-CURRENT #0: Mon Mar  6 12:49:57 CST 2006     root@tkuik-freebsd.cisco:/usr/obj/usr/src/sys/GENERIC  i386
>
>>Description:
>in kern_tc.c: tc_cpu_ticks(), the line
>base += tc->tc_counter_mask + 1;
>will cause a 32 bit overflow if the tc_counter_mask is 0xffffffff, resulting in base not being incremented.
>>How-To-Repeat:
>As long as the mask is set to 0xffffffff, it will always happen.
>>Fix:
>Change the line to:
>base += (uint64_t)(tc->tc_counter_mask) + 1;
>>Release-Note:
>>Audit-Trail:
>>Unformatted:
>_______________________________________________
>freebsd-bugs@freebsd.org mailing list
>http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
>To unsubscribe, send any mail to "freebsd-bugs-unsubscribe@freebsd.org"
>

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk@FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.
Comment 2 Mark Linimon freebsd_committer freebsd_triage 2006-03-09 00:25:51 UTC 
State Changed
From-To: open->closed

phk claims that this has already been committed.