Re: [PATCH] hrtimer: Use hard expiry when updating timers on the same base

[Peter Zijlstra <peterz@infradead.org>]

On Mon, Sep 07, 2026 at 11:11:33PM +0200, Andrea Parri wrote:
> Rearming a queued timer with nonzero slack can leave the timerqueue out
> of order. remove_and_enqueue_same_base() checks the new soft expiry
> against its neighbours' hard expiries, then stores the new hard expiry
> in the node without requeueing it.
> 
> For example, with A at 10 and B at 20, rearming A at 11 with slack 30
> passes the neighbour check but leaves A's hard expiry of 41 before B's
> 20. The same function also caches the soft expiry in base->expires_next
> when updating or inserting the first timer, giving next-event selection
> an earlier deadline than the queue head's hard expiry.
> 
> Compute the hard expiry with the same saturating addition used by
> hrtimer_set_expires_range_ns(). Use it for the in-place ordering check
> and both updates to base->expires_next.
> 
> Fixes: eddffab8282e3 ("hrtimer: Keep track of first expiring timer per clock base")
> Fixes: 343f2f4dc5425 ("hrtimer: Try to modify timers in place")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Andrea Parri <parri.andrea@gmail.com>

Urgh!

> ---
>  kernel/time/hrtimer.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
> index 530d61257b9a0..c5940323746db 100644
> --- a/kernel/time/hrtimer.c
> +++ b/kernel/time/hrtimer.c
> @@ -1261,6 +1261,7 @@ static inline bool
>  remove_and_enqueue_same_base(struct hrtimer *timer, struct hrtimer_clock_base *base,
>  			     const enum hrtimer_mode mode, ktime_t expires, u64 delta_ns)
>  {
> +	ktime_t hard_expires = ktime_add_safe(expires, ns_to_ktime(delta_ns));
>  	bool was_first = false;
>  
>  	/* Remove it from the timer queue if active */
> @@ -1268,11 +1269,11 @@ remove_and_enqueue_same_base(struct hrtimer *timer, struct hrtimer_clock_base *b
>  		was_first = !timerqueue_linked_prev(&timer->node);
>  
>  		/* Try to update in place to avoid the de/enqueue dance */
> -		if (hrtimer_can_update_in_place(timer, base, expires)) {
> +		if (hrtimer_can_update_in_place(timer, base, hard_expires)) {
>  			hrtimer_set_expires_range_ns(timer, expires, delta_ns);
>  			trace_hrtimer_start(timer, mode, true);
>  			if (was_first)
> -				base->expires_next = expires;
> +				base->expires_next = hard_expires;
>  			return was_first;
>  		}
>  
> @@ -1291,7 +1292,7 @@ remove_and_enqueue_same_base(struct hrtimer *timer, struct hrtimer_clock_base *b
>  
>  	/* If it's the first expiring timer now or again, update base */
>  	if (timerqueue_linked_add(&base->active, &timer->node)) {
> -		base->expires_next = expires;
> +		base->expires_next = hard_expires;
>  		return true;
>  	}

Can't we do something like so?

diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index 530d61257b9a..8c157c4fa699 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -1263,13 +1263,16 @@ remove_and_enqueue_same_base(struct hrtimer *timer, struct hrtimer_clock_base *b
 {
 	bool was_first = false;
 
+	/* Set the new expiry time */
+	hrtimer_set_expires_range_ns(timer, expires, delta_ns);
+	expires = timer->node.expires;
+
 	/* Remove it from the timer queue if active */
 	if (timer->is_queued) {
 		was_first = !timerqueue_linked_prev(&timer->node);
 
 		/* Try to update in place to avoid the de/enqueue dance */
 		if (hrtimer_can_update_in_place(timer, base, expires)) {
-			hrtimer_set_expires_range_ns(timer, expires, delta_ns);
 			trace_hrtimer_start(timer, mode, true);
 			if (was_first)
 				base->expires_next = expires;
@@ -1280,9 +1283,6 @@ remove_and_enqueue_same_base(struct hrtimer *timer, struct hrtimer_clock_base *b
 		timerqueue_linked_del(&base->active, &timer->node);
 	}
 
-	/* Set the new expiry time */
-	hrtimer_set_expires_range_ns(timer, expires, delta_ns);
-
 	debug_activate(timer, mode, timer->is_queued);
 	base->cpu_base->active_bases |= 1 << base->index;