[LTP] [PATCH v7 1/2] lib: Fix overflow in backoff polling and timeout multiplication

[Li Wang]

Hi Wake,

This patch is not necessary, the overflow is not reachable in practice.

MAX_DELAY is a compile-time constant <= 30 at all call sites, so
'MAX_DELAY * 1000000' never overflows int. And the backoff would
need tst_delay_ to reach 2^31 (a single ~35 min usleep) to wrap,
which the loop-device probing never approaches regardless of
LTP_TIMEOUT_MUL.

So, I'd prefer to keep the change minimal and apply only v6.


On Mon, Aug 10, 2026 at 02:58:16AM +0000, Wake Liu via ltp wrote:
> Prevent integer overflow in TST_RETRY_FN_EXP_BACKOFF() when the delay
> doubles. By using 'unsigned long long' for delay variables, we ensure
> the doubled delay is safely represented without wrapping to 0 (which
> causes an infinite loop). The loop will naturally terminate when the
> 64-bit delay exceeds 'tst_max_delay_' (capped at UINT_MAX).
> 
> Also fix potential overflow in tst_multiply_timeout() when the
> multiplied timeout exceeds UINT_MAX. Perform the calculation in double
> precision and cap the result at UINT_MAX.
> 
> Signed-off-by: Wake Liu <wakel@google.com>
> ---
>  include/tst_common.h |  4 +++-
>  lib/tst_test.c       | 11 +++++++++--
>  2 files changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/include/tst_common.h b/include/tst_common.h
> index e1f7c7907..058060fa4 100644
> --- a/include/tst_common.h
> +++ b/include/tst_common.h
> @@ -26,6 +26,8 @@
>  #define LTP_ALIGN(x, a)    __LTP_ALIGN_MASK(x, (typeof(x))(a) - 1)
>  #define __LTP_ALIGN_MASK(x, mask)  (((x) + (mask)) & ~(mask))
>  
> +unsigned int tst_multiply_timeout(unsigned int timeout);
> +
>  /**
>   * TST_RETRY_FUNC() - Repeatedly retry a function with an increasing delay.
>   * @FUNC - The function which will be retried
> @@ -42,7 +44,7 @@
>  	TST_RETRY_FN_EXP_BACKOFF(FUNC, ECHCK, 1)
>  
>  #define TST_RETRY_FN_EXP_BACKOFF(FUNC, ECHCK, MAX_DELAY)	\
> -({	unsigned int tst_delay_, tst_max_delay_;			\
> +({	unsigned long long tst_delay_, tst_max_delay_;			\
>  	typeof(FUNC) tst_ret_;						\
>  	tst_delay_ = 1;							\
>  	tst_max_delay_ = tst_multiply_timeout(MAX_DELAY * 1000000);	\
> diff --git a/lib/tst_test.c b/lib/tst_test.c
> index 5c3607016..80463e7c6 100644
> --- a/lib/tst_test.c
> +++ b/lib/tst_test.c
> @@ -1855,10 +1855,17 @@ unsigned int tst_multiply_timeout(unsigned int timeout)
>  	if (timeout < 1)
>  		tst_brk(TBROK, "timeout must to be >= 1! (%d)", timeout);
>  
> +	double t = timeout;
> +
>  	if (tst_has_slow_kconfig())
> -		timeout *= 4;
> +		t *= 4;
> +
> +	t *= timeout_mul;
> +
> +	if (t > (double)UINT_MAX)
> +		return UINT_MAX;
>  
> -	return timeout * timeout_mul;
> +	return t;
>  }
>  
>  static void set_overall_timeout(void)
> -- 
> 2.55.0.654.g21b8a5bc05-goog
> 
> 
> -- 
> Mailing list info: https://lists.linux.it/listinfo/ltp

-- 
Regards,
Li Wang