From: Thomas Gleixner <tglx@linutronix.de>
To: Tejun Heo <tj@kernel.org>
Cc: Chris Worley <chris.worley@primarydata.com>,
linux-kernel@vger.kernel.org, bfields@fieldses.org,
Michael Skralivetsky <michael.skralivetsky@primarydata.com>,
Trond Myklebust <trond.myklebust@primarydata.com>,
Shaohua Li <shli@fb.com>, Jeff Layton <jlayton@poochiereds.net>,
kernel-team@fb.com
Subject: Re: [PATCH] timer: add_timer_on() should perform proper migration
Date: Wed, 4 Nov 2015 20:35:00 +0100 (CET) [thread overview]
Message-ID: <alpine.DEB.2.11.1511042025160.4032@nanos> (raw)
In-Reply-To: <20151104171533.GI5749@mtj.duckdns.org>
Tejun,
On Wed, 4 Nov 2015, Tejun Heo wrote:
> Regardless of the previous CPU a timer was on, add_timer_on()
> currently simply sets timer->flags to the new CPU. As the caller must
> be seeing the timer as idle, this is locally fine, but the timer
> leaving the old base while unlocked can lead to race conditions as
> follows.
nice detective work. This has been there forever. I really wonder why
nobody ever triggered this before.
@stable:
The patch does only apply to kernels >= 4.2. Backport for older
kernels is below.
Thanks,
tglx
----------->
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -966,13 +966,26 @@ EXPORT_SYMBOL(add_timer);
*/
void add_timer_on(struct timer_list *timer, int cpu)
{
- struct tvec_base *base = per_cpu(tvec_bases, cpu);
+ struct tvec_base *new_base = per_cpu(tvec_bases, cpu);
+ struct tvec_base *base;
unsigned long flags;
timer_stats_timer_set_start_info(timer);
BUG_ON(timer_pending(timer) || !timer->function);
- spin_lock_irqsave(&base->lock, flags);
- timer_set_base(timer, base);
+
+ /*
+ * If @timer was on a different CPU, it should be migrated with the
+ * old base locked to prevent other operations proceeding with the
+ * wrong base locked. See lock_timer_base().
+ */
+ base = lock_timer_base(timer, &flags);
+ if (base != new_base) {
+ timer_set_base(timer, NULL);
+ spin_unlock(&base->lock);
+ base = new_base;
+ spin_lock(&base->lock);
+ timer_set_base(timer, base);
+ }
debug_activate(timer, timer->expires);
internal_add_timer(base, timer);
spin_unlock_irqrestore(&base->lock, flags);
next prev parent reply other threads:[~2015-11-04 19:35 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-29 14:31 timer code oops when calling mod_delayed_work Jeff Layton
2015-10-29 17:58 ` Jeff Layton
2015-10-31 2:00 ` Tejun Heo
2015-10-31 11:34 ` Jeff Layton
2015-10-31 21:31 ` Tejun Heo
2015-10-31 21:54 ` Jeff Layton
2015-11-02 19:48 ` Chris Worley
2015-11-02 19:56 ` Jeff Layton
2015-11-03 1:33 ` Jeff Layton
2015-11-03 17:55 ` Jeff Layton
2015-11-03 22:54 ` Tejun Heo
2015-11-04 0:06 ` Tejun Heo
2015-11-04 11:48 ` Jeff Layton
2015-11-04 17:15 ` [PATCH] timer: add_timer_on() should perform proper migration Tejun Heo
2015-11-04 19:27 ` [tip:timers/urgent] timers: Use proper base migration in add_timer_on() tip-bot for Tejun Heo
2015-11-04 19:35 ` Thomas Gleixner [this message]
2015-11-04 19:43 ` [PATCH] timer: add_timer_on() should perform proper migration Tejun Heo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.11.1511042025160.4032@nanos \
--to=tglx@linutronix.de \
--cc=bfields@fieldses.org \
--cc=chris.worley@primarydata.com \
--cc=jlayton@poochiereds.net \
--cc=kernel-team@fb.com \
--cc=linux-kernel@vger.kernel.org \
--cc=michael.skralivetsky@primarydata.com \
--cc=shli@fb.com \
--cc=tj@kernel.org \
--cc=trond.myklebust@primarydata.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).