Skip to content

Commit d2c0ba1

Browse files
committed
kernel: sched: fix possible integer overflow in z_tick_sleep()
Fix Coverity CID 529867 (CWE-190): z_tick_sleep() may return a large tick count due to wraparound during unsigned tick subtraction. This patch replaces unsigned subtraction with signed arithmetic to safely handle tick count wraparound and avoid returning incorrect values after timeout abortion. Fixes: #92601 Signed-off-by: sudarsan N <sudarsansamy2002@gmail.com>
1 parent e22ca6b commit d2c0ba1

File tree

1 file changed

+4
-6
lines changed

1 file changed

+4
-6
lines changed

kernel/sched.c

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1117,13 +1117,11 @@ static int32_t z_tick_sleep(k_timeout_t timeout)
11171117
}
11181118

11191119
/* We require a 32 bit unsigned subtraction to care a wraparound */
1120-
uint32_t left_ticks = expected_wakeup_ticks - sys_clock_tick_get_32();
1120+
uint32_t now = sys_clock_tick_get_32();
1121+
int32_t remaining = (int32_t)(expected_wakeup_ticks - now);
11211122

1122-
/* To handle a negative value correctly, once type-cast it to signed 32 bit */
1123-
k_ticks_t ticks = (k_ticks_t)(int32_t)left_ticks;
1124-
1125-
if (ticks > 0) {
1126-
return ticks;
1123+
if (remaining > 0) {
1124+
return (k_ticks_t)remaining;
11271125
}
11281126

11291127
return 0;

0 commit comments

Comments
 (0)