On Mon, 17 Aug 2015, Eric Dumazet wrote:
> [PATCH] timer: fix a race in __mod_timer()
>
> lock_timer_base() can not catch following :
>
> CPU1 ( in __mod_timer()
> timer->flags |= TIMER_MIGRATING;
> spin_unlock(&base->lock);
> base = new_base;
> spin_lock(&base->lock);
> timer->flags &= ~TIMER_BASEMASK;
> CPU2 (in lock_timer_base())
> see timer base is cpu0 base
> spin_lock_irqsave(&base->lock, *flags);
> if (timer->flags == tf)
> return base; // oops, wrong base
> timer->flags |= base->cpu // too late
>
> We must write timer->flags in one go, otherwise we can fool other cpus.
>
> Fixes: bc7a34b8b9eb ("timer: Reduce timer migration overhead if disabled")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Cc: Thomas Gleixner <t...@linutronix.de>
> ---
> kernel/time/timer.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/time/timer.c b/kernel/time/timer.c
> index 5e097fa9faf7..84190f02b521 100644
> --- a/kernel/time/timer.c
> +++ b/kernel/time/timer.c
> @@ -807,8 +807,8 @@ __mod_timer(struct timer_list *timer, unsigned long
> expires,
> spin_unlock(&base->lock);
> base = new_base;
> spin_lock(&base->lock);
> - timer->flags &= ~TIMER_BASEMASK;
> - timer->flags |= base->cpu;
> + WRITE_ONCE(timer->flags,
> + (timer->flags & ~TIMER_BASEMASK) |
> base->cpu);
Duh, yes. Picking it up for timers/urgent.
Thanks for spotting it.
tglx
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
