[LTP] [PATCH v7 1/2] lib: Fix overflow in backoff polling and timeout multiplication

[Wake Liu via ltp <ltp@lists.linux.it>]

Prevent integer overflow in TST_RETRY_FN_EXP_BACKOFF() when the delay
doubles. By using 'unsigned long long' for delay variables, we ensure
the doubled delay is safely represented without wrapping to 0 (which
causes an infinite loop). The loop will naturally terminate when the
64-bit delay exceeds 'tst_max_delay_' (capped at UINT_MAX).

Also fix potential overflow in tst_multiply_timeout() when the
multiplied timeout exceeds UINT_MAX. Perform the calculation in double
precision and cap the result at UINT_MAX.

Signed-off-by: Wake Liu <wakel@google.com>
---
 include/tst_common.h |  4 +++-
 lib/tst_test.c       | 11 +++++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/include/tst_common.h b/include/tst_common.h
index e1f7c7907..058060fa4 100644
--- a/include/tst_common.h
+++ b/include/tst_common.h
@@ -26,6 +26,8 @@
 #define LTP_ALIGN(x, a)    __LTP_ALIGN_MASK(x, (typeof(x))(a) - 1)
 #define __LTP_ALIGN_MASK(x, mask)  (((x) + (mask)) & ~(mask))
 
+unsigned int tst_multiply_timeout(unsigned int timeout);
+
 /**
  * TST_RETRY_FUNC() - Repeatedly retry a function with an increasing delay.
  * @FUNC - The function which will be retried
@@ -42,7 +44,7 @@
 	TST_RETRY_FN_EXP_BACKOFF(FUNC, ECHCK, 1)
 
 #define TST_RETRY_FN_EXP_BACKOFF(FUNC, ECHCK, MAX_DELAY)	\
-({	unsigned int tst_delay_, tst_max_delay_;			\
+({	unsigned long long tst_delay_, tst_max_delay_;			\
 	typeof(FUNC) tst_ret_;						\
 	tst_delay_ = 1;							\
 	tst_max_delay_ = tst_multiply_timeout(MAX_DELAY * 1000000);	\
diff --git a/lib/tst_test.c b/lib/tst_test.c
index 5c3607016..80463e7c6 100644
--- a/lib/tst_test.c
+++ b/lib/tst_test.c
@@ -1855,10 +1855,17 @@ unsigned int tst_multiply_timeout(unsigned int timeout)
 	if (timeout < 1)
 		tst_brk(TBROK, "timeout must to be >= 1! (%d)", timeout);
 
+	double t = timeout;
+
 	if (tst_has_slow_kconfig())
-		timeout *= 4;
+		t *= 4;
+
+	t *= timeout_mul;
+
+	if (t > (double)UINT_MAX)
+		return UINT_MAX;
 
-	return timeout * timeout_mul;
+	return t;
 }
 
 static void set_overall_timeout(void)
-- 
2.55.0.654.g21b8a5bc05-goog


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp