posix timers: Improve the overrun calculation

[markj]

Summary

timer_settime(2) may be used to configure a timeout in the past. If
the timer is also periodic, we also try to compute the number of timer
overruns that occurred between the initial timeout and the time at which
the timer fired. This is done in a loop which iterates once per period
between the initial timeout and now. If the period is small and the
initial timeout was a long time ago, this loop can take forever to run,
so the system is effectively DOSed.

Replace the loop with a more direct calculation of
(now - initial timeout) / period to compute the number of overruns.

Reported by: syzkaller

[kib]

sys/kern/kern_time.c

1640

but now - value can overflow if unchecked

1641

same for it_overrun + overruns

Both overflows are not UB but I think we want to avoid them nonetheless for correctness, since we check for other overflow there?

[markj]

sys/kern/kern_time.c

1640

Which overflow do you mean exactly? We know that now >= value here.

[kib]

sys/kern/kern_time.c

1640

Yes, this comment is nonsensical. But I still think it_overrun+overruns can overflow

[markj]

Try to handle overflow when computing the 64-bit number of overruns.