summaryrefslogtreecommitdiffstats
path: root/kernel/torture.c
diff options
context:
space:
mode:
authorThomas Gleixner <tglx@linutronix.de>2016-10-22 11:07:37 +0000
committerThomas Gleixner <tglx@linutronix.de>2016-10-25 16:32:50 +0200
commit6bad6bccf2d717f652d37e63cf261eaa23466009 (patch)
tree9a22c3c4a778297bf544a0cc89da0c76c8784d6b /kernel/torture.c
parent041ad7bc758db259bb960ef795197dd14aab19a6 (diff)
downloadlinux-6bad6bccf2d717f652d37e63cf261eaa23466009.tar.gz
linux-6bad6bccf2d717f652d37e63cf261eaa23466009.tar.bz2
linux-6bad6bccf2d717f652d37e63cf261eaa23466009.zip
timers: Prevent base clock corruption when forwarding
When a timer is enqueued we try to forward the timer base clock. This mechanism has two issues: 1) Forwarding a remote base unlocked The forwarding function is called from get_target_base() with the current timer base lock held. But if the new target base is a different base than the current base (can happen with NOHZ, sigh!) then the forwarding is done on an unlocked base. This can lead to corruption of base->clk. Solution is simple: Invoke the forwarding after the target base is locked. 2) Possible corruption due to jiffies advancing This is similar to the issue in get_net_timer_interrupt() which was fixed in the previous patch. jiffies can advance between check and assignement and therefore advancing base->clk beyond the next expiry value. So we need to read jiffies into a local variable once and do the checks and assignment with the local copy. Fixes: a683f390b93f("timers: Forward the wheel clock whenever possible") Reported-by: Ashton Holmes <scoopta@gmail.com> Reported-by: Michael Thayer <michael.thayer@oracle.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Michal Necasek <michal.necasek@oracle.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: knut.osmundsen@oracle.com Cc: stable@vger.kernel.org Cc: stern@rowland.harvard.edu Cc: rt@linutronix.de Link: http://lkml.kernel.org/r/20161022110552.253640125@linutronix.de Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Diffstat (limited to 'kernel/torture.c')
0 files changed, 0 insertions, 0 deletions