From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759308AbcJYO6b (ORCPT ); Tue, 25 Oct 2016 10:58:31 -0400 Received: from terminus.zytor.com ([198.137.202.10]:37606 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755929AbcJYO63 (ORCPT ); Tue, 25 Oct 2016 10:58:29 -0400 Date: Tue, 25 Oct 2016 07:57:54 -0700 From: tip-bot for Thomas Gleixner Message-ID: Cc: hpa@zytor.com, tglx@linutronix.de, mingo@kernel.org, peterz@infradead.org, linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org Reply-To: peterz@infradead.org, mingo@kernel.org, hpa@zytor.com, tglx@linutronix.de, akpm@linux-foundation.org, torvalds@linux-foundation.org, linux-kernel@vger.kernel.org In-Reply-To: References: To: linux-tip-commits@vger.kernel.org Subject: [tip:timers/urgent] timers: Plug locking race vs. timer migration Git-Commit-ID: b831275a3553c32091222ac619cfddd73a5553fb X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: b831275a3553c32091222ac619cfddd73a5553fb Gitweb: http://git.kernel.org/tip/b831275a3553c32091222ac619cfddd73a5553fb Author: Thomas Gleixner AuthorDate: Mon, 24 Oct 2016 11:41:56 +0200 Committer: Thomas Gleixner CommitDate: Tue, 25 Oct 2016 16:27:39 +0200 timers: Plug locking race vs. timer migration Linus noticed that lock_timer_base() lacks a READ_ONCE() for accessing the timer flags. As a consequence the compiler is allowed to reload the flags between the initial check for TIMER_MIGRATION and the following timer base computation and the spin lock of the base. While this has not been observed (yet), we need to make sure that it never happens. Fixes: 0eeda71bc30d ("timer: Replace timer base by a cpu index") Reported-by: Linus Torvalds Signed-off-by: Thomas Gleixner Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1610241711220.4983@nanos Cc: stable@vger.kernel.org Cc: Andrew Morton Cc: Peter Zijlstra --- kernel/time/timer.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/kernel/time/timer.c b/kernel/time/timer.c index 2d47980..0d4b91c 100644 --- a/kernel/time/timer.c +++ b/kernel/time/timer.c @@ -943,7 +943,14 @@ static struct timer_base *lock_timer_base(struct timer_list *timer, { for (;;) { struct timer_base *base; - u32 tf = timer->flags; + u32 tf; + + /* + * We need to use READ_ONCE() here, otherwise the compiler + * might re-read @tf between the check for TIMER_MIGRATING + * and spin_lock(). + */ + tf = READ_ONCE(timer->flags); if (!(tf & TIMER_MIGRATING)) { base = get_timer_base(tf);