[PATCH] hrtimer: Use the mask to clear TIF_HRTIMER_REARM from the exit work

[PATCH] hrtimer: Use the mask to clear TIF_HRTIMER_REARM from the exit work

[Karl Mehltretter]

hrtimer_rearm_deferred_user_irq() removes the rearm bit from the local
copy of the TIF work with:

	*tif_work &= ~TIF_HRTIMER_REARM;

TIF_HRTIMER_REARM is the bit number (12), not the mask. That clears
TIF_NOTIFY_SIGNAL (bit 2) and TIF_MEMDIE (bit 3) from the copy and
leaves bit 12 set.

So the function never returns true, and the copy handed to
exit_to_user_mode_loop() lacks TIF_NOTIFY_SIGNAL. If that was the only
work for the loop, the task returns to user space with the task work
still pending. hrtimer_interrupt() sets TIF_HRTIMER_REARM every time,
so the next tick repeats that. Task work queued with TWA_SIGNAL from a
hrtimer callback stays pending until the task does a syscall, takes an
interrupt without deferred rearm or has to reschedule.

A task which polls the io_uring completion ring in user space sees a
timeout completion after 30ms (median) instead of 70us. 2 CPU QEMU
guest, HZ=1000.

Use the mask.

Fixes: 15dd3a948855 ("hrtimer: Push reprogramming timers into the interrupt return path")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 include/linux/hrtimer_rearm.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/hrtimer_rearm.h b/include/linux/hrtimer_rearm.h
index 17a81826bd9a9..12e42721c8e01 100644
--- a/include/linux/hrtimer_rearm.h
+++ b/include/linux/hrtimer_rearm.h
@@ -45,7 +45,7 @@ hrtimer_rearm_deferred_user_irq(unsigned long *tif_work, const unsigned long tif
 		clear_thread_flag(TIF_HRTIMER_REARM);
 		__hrtimer_rearm_deferred();
 		/* Don't go into the loop if HRTIMER_REARM was the only flag */
-		*tif_work &= ~TIF_HRTIMER_REARM;
+		*tif_work &= ~_TIF_HRTIMER_REARM;
 		return !*tif_work;
 	}
 	return false;

base-commit: 40288c9206c17eb66a603262e06a58d300d0f279
-- 
2.53.0

Re: [PATCH] hrtimer: Use the mask to clear TIF_HRTIMER_REARM from the exit work

[Karl Mehltretter]

On Sat, Sep 19, 2026 at 04:40:27PM +0100, Karl Mehltretter wrote:
> TIF_HRTIMER_REARM is the bit number (12), not the mask. That clears
> TIF_NOTIFY_SIGNAL (bit 2) and TIF_MEMDIE (bit 3) from the copy and
> leaves bit 12 set.
> 
> So the function never returns true, and the copy handed to
> exit_to_user_mode_loop() lacks TIF_NOTIFY_SIGNAL. If that was the only
> work for the loop, the task returns to user space with the task work
> still pending. hrtimer_interrupt() sets TIF_HRTIMER_REARM every time,
> so the next tick repeats that. Task work queued with TWA_SIGNAL from a
> hrtimer callback stays pending until the task does a syscall, takes an
> interrupt without deferred rearm or has to reschedule.
> 
> A task which polls the io_uring completion ring in user space sees a
> timeout completion after 30ms (median) instead of 70us. 2 CPU QEMU
> guest, HZ=1000.
> 
> Use the mask.

The patch also fixes longer delays I found with NO_HZ_FULL.

Same 2-CPU x86-64 QEMU guest, nohz_full=1 rcu_nocbs=1, polling on
CPU 1. For 6,000 3 ms timeouts per kernel across three boots:

             More than 50 ms late    Worst delay
  Unpatched       239 (4%)             991 ms
  Patched           0                  5.7 ms

Most callbacks run on the housekeeping CPU and avoid the bug. A
traced local expiry was followed by a 737 ms gap until a
call-function IPI.

Thanks,
Karl

[tip: timers/urgent] hrtimer: Use the mask to clear TIF_HRTIMER_REARM from the exit work

[tip-bot2 for Karl Mehltretter]

The following commit has been merged into the timers/urgent branch of tip:

Commit-ID:     28fa9af353bed2bb738c46e31f9b7d0347b759d1
Gitweb:        https://git.kernel.org/tip/28fa9af353bed2bb738c46e31f9b7d0347b759d1
Author:        Karl Mehltretter <kmehltretter@gmail.com>
AuthorDate:    Sat, 19 Sep 2026 16:40:27 +02:00
Committer:     Thomas Gleixner <tglx@kernel.org>
CommitterDate: Tue, 29 Sep 2026 23:42:11 +02:00

hrtimer: Use the mask to clear TIF_HRTIMER_REARM from the exit work

hrtimer_rearm_deferred_user_irq() removes the rearm bit from the local
copy of the TIF work with:

	*tif_work &= ~TIF_HRTIMER_REARM;

TIF_HRTIMER_REARM is the bit number (12), not the mask. That clears
TIF_NOTIFY_SIGNAL (bit 2) and TIF_MEMDIE (bit 3) from the copy and
leaves bit 12 set.

So the function never returns true, and the copy handed to
exit_to_user_mode_loop() lacks TIF_NOTIFY_SIGNAL. If that was the only
work for the loop, the task returns to user space with the task work
still pending. hrtimer_interrupt() sets TIF_HRTIMER_REARM every time,
so the next tick repeats that. Task work queued with TWA_SIGNAL from a
hrtimer callback stays pending until the task does a syscall, takes an
interrupt without deferred rearm or has to reschedule.

A task which polls the io_uring completion ring in user space sees a
timeout completion after 30ms (median) instead of 70us. 2 CPU QEMU
guest, HZ=1000.

Use the mask.

Fixes: 15dd3a948855 ("hrtimer: Push reprogramming timers into the interrupt return path")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260919144027.70250-1-kmehltretter@gmail.com
---
 include/linux/hrtimer_rearm.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/hrtimer_rearm.h b/include/linux/hrtimer_rearm.h
index 17a8182..12e4272 100644
--- a/include/linux/hrtimer_rearm.h
+++ b/include/linux/hrtimer_rearm.h
@@ -45,7 +45,7 @@ hrtimer_rearm_deferred_user_irq(unsigned long *tif_work, const unsigned long tif
 		clear_thread_flag(TIF_HRTIMER_REARM);
 		__hrtimer_rearm_deferred();
 		/* Don't go into the loop if HRTIMER_REARM was the only flag */
-		*tif_work &= ~TIF_HRTIMER_REARM;
+		*tif_work &= ~_TIF_HRTIMER_REARM;
 		return !*tif_work;
 	}
 	return false;