lkml.org 
[lkml]   [2019]   [Sep]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[patch 1/6] posix-cpu-timers: Always clear head pointer on dequeue
The head pointer in struct cpu_timer is checked to be NULL in
posix_cpu_timer_del() when the delete raced with the exit cleanup. The
works correctly as long as the timer is actually dequeued via
posix_cpu_timers_exit*().

But if the timer was dequeued due to expiry the head pointer is still set
and triggers the warning.

In fact keeping the head pointer around after any dequeue is pointless as
is has no meaning at all after that.

Clear the head pointer always on dequeue and remove the unused requeue
function while at it.

Fixes: 60bda037f1dd ("posix-cpu-timers: Utilize timerqueue for storage")
Reported-by: syzbot+55acd54b57bb4b3840a4@syzkaller.appspotmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
---
include/linux/posix-timers.h | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)

--- a/include/linux/posix-timers.h
+++ b/include/linux/posix-timers.h
@@ -74,11 +74,6 @@ struct cpu_timer {
int firing;
};

-static inline bool cpu_timer_requeue(struct cpu_timer *ctmr)
-{
- return timerqueue_add(ctmr->head, &ctmr->node);
-}
-
static inline bool cpu_timer_enqueue(struct timerqueue_head *head,
struct cpu_timer *ctmr)
{
@@ -88,8 +83,10 @@ static inline bool cpu_timer_enqueue(str

static inline void cpu_timer_dequeue(struct cpu_timer *ctmr)
{
- if (!RB_EMPTY_NODE(&ctmr->node.node))
+ if (ctmr->head) {
timerqueue_del(ctmr->head, &ctmr->node);
+ ctmr->head = NULL;
+ }
}

static inline u64 cpu_timer_getexpires(struct cpu_timer *ctmr)

\
 
 \ /
  Last update: 2019-09-05 14:13    [W:0.159 / U:1.164 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site