diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2021-08-08 11:53:30 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2021-08-08 11:53:30 -0700 |
commit | cceb634774efca60f8cc57041234f00faf97f22d (patch) | |
tree | 1b046122ef1870261e384a492e4fcaeb3130dec5 /kernel | |
parent | 713f0f37e8128e8a0190a98f5a4be71fb32a671a (diff) | |
parent | bb7262b295472eb6858b5c49893954794027cd84 (diff) | |
download | linux-stable-cceb634774efca60f8cc57041234f00faf97f22d.tar.gz linux-stable-cceb634774efca60f8cc57041234f00faf97f22d.tar.bz2 linux-stable-cceb634774efca60f8cc57041234f00faf97f22d.zip |
Merge tag 'timers-urgent-2021-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fix from Thomas Gleixner:
"A single timer fix:
- Prevent a memory ordering issue in the timer expiry code which
makes it possible to observe falsely that the callback has been
executed already while that's not the case, which violates the
guarantee of del_timer_sync()"
* tag 'timers-urgent-2021-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
timers: Move clearing of base::timer_running under base:: Lock
Diffstat (limited to 'kernel')
-rw-r--r-- | kernel/time/timer.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/kernel/time/timer.c b/kernel/time/timer.c index 9eb11c2209e5..e3d2c23c413d 100644 --- a/kernel/time/timer.c +++ b/kernel/time/timer.c @@ -1265,8 +1265,10 @@ static inline void timer_base_unlock_expiry(struct timer_base *base) static void timer_sync_wait_running(struct timer_base *base) { if (atomic_read(&base->timer_waiters)) { + raw_spin_unlock_irq(&base->lock); spin_unlock(&base->expiry_lock); spin_lock(&base->expiry_lock); + raw_spin_lock_irq(&base->lock); } } @@ -1457,14 +1459,14 @@ static void expire_timers(struct timer_base *base, struct hlist_head *head) if (timer->flags & TIMER_IRQSAFE) { raw_spin_unlock(&base->lock); call_timer_fn(timer, fn, baseclk); - base->running_timer = NULL; raw_spin_lock(&base->lock); + base->running_timer = NULL; } else { raw_spin_unlock_irq(&base->lock); call_timer_fn(timer, fn, baseclk); + raw_spin_lock_irq(&base->lock); base->running_timer = NULL; timer_sync_wait_running(base); - raw_spin_lock_irq(&base->lock); } } } |