[PATCH v2] rust: time: fix as_micros_ceil() rounding near i64::MAX

[PATCH v2] rust: time: fix as_micros_ceil() rounding near i64::MAX

[FUJITA Tomonori]

From: FUJITA Tomonori <fujita.tomonori@gmail.com>

The ceiling adjustment used saturating_add(NSEC_PER_USEC - 1) before
dividing. Once the nanosecond value gets within NSEC_PER_USEC - 1 of
i64::MAX the addition saturates to i64::MAX, which drops the ceiling
bias and can yield a result one microsecond too small.

Fixes: fae0cdc12340 ("rust: time: Introduce Delta type")
Reported-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Closes: https://lore.kernel.org/rust-for-linux/CANiq72mtS0ABA2JnT5tpz6J9c_mnxY+vyPvghV_ukngWvN8F2w@mail.gmail.com/
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
---
v2
- Add the comment; no functional change
v1: https://lore.kernel.org/all/20260723120907.209643-1-tomo@flapping.org/

---
 rust/kernel/time.rs | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/rust/kernel/time.rs b/rust/kernel/time.rs
index b8463823aed9..54fc46d460b6 100644
--- a/rust/kernel/time.rs
+++ b/rust/kernel/time.rs
@@ -441,22 +441,25 @@ pub const fn as_nanos(self) -> i64 {
     /// to the value in the [`Delta`].
     #[inline]
     pub fn as_micros_ceil(self) -> i64 {
+        // Only positive values need to be rounded up: truncating division already
+        // rounds towards zero, i.e. up, for negative values.
+        //
+        // The usual `(nanos + d - 1) / d` is not used because the addition overflows
+        // once `nanos` exceeds `i64::MAX - (d - 1)`; saturating the addition instead
+        // would drop the rounding bias and return a result one unit too small.
         let n = self.as_nanos();
-        let n = if n >= 0 {
-            n.saturating_add(NSEC_PER_USEC - 1)
-        } else {
-            n
-        };
+
+        let (n, add) = if n > 0 { (n - 1, 1) } else { (n, 0) };
 
         #[cfg(CONFIG_64BIT)]
         {
-            n / NSEC_PER_USEC
+            n / NSEC_PER_USEC + add
         }
 
         #[cfg(not(CONFIG_64BIT))]
         // SAFETY: It is always safe to call `ktime_to_us()` with any value.
         unsafe {
-            bindings::ktime_to_us(n)
+            bindings::ktime_to_us(n) + add
         }
     }
 

base-commit: 075b74841bd0065a3bda3440873c747938e69b68
-- 
2.43.0

Re: [PATCH v2] rust: time: fix as_micros_ceil() rounding near i64::MAX

[Andreas Hindborg]

"FUJITA Tomonori" <tomo@flapping.org> writes:

> From: FUJITA Tomonori <fujita.tomonori@gmail.com>
>
> The ceiling adjustment used saturating_add(NSEC_PER_USEC - 1) before
> dividing. Once the nanosecond value gets within NSEC_PER_USEC - 1 of
> i64::MAX the addition saturates to i64::MAX, which drops the ceiling
> bias and can yield a result one microsecond too small.
>
> Fixes: fae0cdc12340 ("rust: time: Introduce Delta type")
> Reported-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
> Closes: https://lore.kernel.org/rust-for-linux/CANiq72mtS0ABA2JnT5tpz6J9c_mnxY+vyPvghV_ukngWvN8F2w@mail.gmail.com/
> Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>


Acked-by: Andreas Hindborg <a.hindborg@kernel.org>

@Miguel, can you take this one through rust or rust-fixes?


Best regards,
Andreas Hindborg