From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753652AbdDNOIl (ORCPT ); Fri, 14 Apr 2017 10:08:41 -0400 Received: from muru.com ([72.249.23.125]:44376 "EHLO muru.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753497AbdDNOIf (ORCPT ); Fri, 14 Apr 2017 10:08:35 -0400 From: Tony Lindgren To: Thomas Gleixner , Peter Zijlstra Cc: linux-kernel@vger.kernel.org, juri.lelli@arm.com, bigeasy@linutronix.de, xlpang@redhat.com, rostedt@goodmis.org, mathieu.desnoyers@efficios.com, jdesfossez@efficios.com, dvhart@infradead.org, bristot@redhat.com Subject: [PATCH] futex: Fix hrtimer oops in futex_lock_pi() Date: Fri, 14 Apr 2017 07:08:19 -0700 Message-Id: <20170414140819.20210-1-tony@atomide.com> X-Mailer: git-send-email 2.12.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit cfafcd117da0 ("futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()") caused a regression where things would occasionally randomly oops when restarting X: Unable to handle kernel NULL pointer dereference at virtual address 00000000 ... Internal error: Oops: 80000005 [#1] SMP ARM ... PC is at 0x0 LR is at __hrtimer_run_queues+0x138/0x58c pc : [<00000000>] lr : [] psr: 20000193 ... [] (__hrtimer_run_queues) from [] (hrtimer_interrupt+0xbc/0x210) [] (hrtimer_interrupt) from [] ... When this happens, the hrtimer is not properly initialized and it's function is NULL. This happens because we now call hrtimer_start_expires() in futex_lock_pi() for the timer initialized with hrtimer_init_on_stack(). To fix it, let's pair the hrtimer_start_expires() with hrtimer_cancel() in the same function. Fixes: cfafcd117da0 ("futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()") Cc: juri.lelli@arm.com Cc: bigeasy@linutronix.de Cc: xlpang@redhat.com Cc: rostedt@goodmis.org Cc: mathieu.desnoyers@efficios.com Cc: jdesfossez@efficios.com Cc: dvhart@infradead.org Cc: bristot@redhat.com Signed-off-by: Tony Lindgren --- kernel/futex.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/futex.c b/kernel/futex.c --- a/kernel/futex.c +++ b/kernel/futex.c @@ -2736,8 +2736,10 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags, out_put_key: put_futex_key(&q.key); out: - if (to) + if (to) { + hrtimer_cancel(&to->timer); destroy_hrtimer_on_stack(&to->timer); + } return ret != -EINTR ? ret : -ERESTARTNOINTR; uaddr_faulted: -- 2.12.2