diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2022-05-25 00:14:33 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2022-07-25 21:01:16 +0000 |
| commit | c48048ebdbed0901dacf1632af3b3db600533e64 (patch) | |
| tree | 25adb51451958b6c4863ee36e987e2adb7fa3518 | |
| parent | db8082886fd8cfbd8a3d533bb530ad392d0c4d85 (diff) | |
| download | src-c48048ebdbed.tar.gz src-c48048ebdbed.zip | |
kevent: Fix an off-by-one in filt_timerexpire_l()
Suppose a periodic kevent timer fires close to its deadline, so that
now - kc->next is small. Then delta ends up being 1, and the next timer
deadline is set to (delta + 1) * kc->to, where kc->to is the timer
period. This means that the timer fires at half of the requested rate,
and the value returned in kn_data is similarly inaccurate.
Approved by: so
Security: FreeBSD-EN-22:16.kqueue
PR: 264131
Fixes: 7cb40543e964 ("filt_timerexpire: do not iterate over the interval")
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 524dadf7a8725dea144571843e611dbdbd59d668)
(cherry picked from commit 129112f80d2bfe6091ebb8656912fb55d6192e1f)
| -rw-r--r-- | sys/kern/kern_event.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c index 2e9773ab5701..e40d4b192dce 100644 --- a/sys/kern/kern_event.c +++ b/sys/kern/kern_event.c @@ -739,7 +739,7 @@ filt_timerexpire_l(struct knote *kn, bool proc_locked) if (delta == 0) delta = 1; kn->kn_data += delta; - kc->next += (delta + 1) * kc->to; + kc->next += delta * kc->to; if (now >= kc->next) /* overflow */ kc->next = now + kc->to; KNOTE_ACTIVATE(kn, 0); /* XXX - handle locking */ |