[lkml]   [2019]   [Aug]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[PATCH 0/1] Fix race in ipmi timer cleanup
From: Jes Sorensen <>

I came across this in 4.16, but I believe the bug is still present
in current 5.x, even if it is less likely to trigger.

Basially stop_timer_and_thread() only calls del_timer_sync() if
timer_running == true. However smi_mod_timer enables the timer before
setting timer_running = true.

I was able to reproduce this in 4.16 running the following on a host

while :; do rmmod ipmi_si ; modprobe ipmi_si; done

while rebooting the BMC on it in parallel.

5.2 moves the error handling around and does it more centralized, but
relying on timer_running still seems dubious to me.

static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
if (!smi_info->timer_can_start)
smi_info->last_timeout_jiffies = jiffies;
mod_timer(&smi_info->si_timer, new_val);
smi_info->timer_running = true;

static inline void stop_timer_and_thread(struct smi_info *smi_info)
if (smi_info->thread != NULL) {
smi_info->thread = NULL;

smi_info->timer_can_start = false;
if (smi_info->timer_running)


Jes Sorensen (1):
ipmi_si_intf: Fix race in timer shutdown handling

drivers/char/ipmi/ipmi_si_intf.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)


 \ /
  Last update: 2019-08-28 22:36    [W:0.098 / U:0.848 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site