kernel_optimize_test/kernel/time
Thomas Gleixner 23e36a8610 timers: Move clearing of base::timer_running under base:: Lock
commit bb7262b295472eb6858b5c49893954794027cd84 upstream.

syzbot reported KCSAN data races vs. timer_base::timer_running being set to
NULL without holding base::lock in expire_timers().

This looks innocent and most reads are clearly not problematic, but
Frederic identified an issue which is:

 int data = 0;

 void timer_func(struct timer_list *t)
 {
    data = 1;
 }

 CPU 0                                            CPU 1
 ------------------------------                   --------------------------
 base = lock_timer_base(timer, &flags);           raw_spin_unlock(&base->lock);
 if (base->running_timer != timer)                call_timer_fn(timer, fn, baseclk);
   ret = detach_if_pending(timer, base, true);    base->running_timer = NULL;
 raw_spin_unlock_irqrestore(&base->lock, flags);  raw_spin_lock(&base->lock);

 x = data;

If the timer has previously executed on CPU 1 and then CPU 0 can observe
base->running_timer == NULL and returns, assuming the timer has completed,
but it's not guaranteed on all architectures. The comment for
del_timer_sync() makes that guarantee. Moving the assignment under
base->lock prevents this.

For non-RT kernel it's performance wise completely irrelevant whether the
store happens before or after taking the lock. For an RT kernel moving the
store under the lock requires an extra unlock/lock pair in the case that
there is a waiter for the timer, but that's not the end of the world.

Reported-by: syzbot+aa7c2385d46c5eba0b89@syzkaller.appspotmail.com
Reported-by: syzbot+abea4558531bae1ba9fe@syzkaller.appspotmail.com
Fixes: 030dcdd197 ("timers: Prepare support for PREEMPT_RT")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/87lfea7gw8.fsf@nanos.tec.linutronix.de
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-08-12 13:22:15 +02:00
..
alarmtimer.c
clockevents.c
clocksource.c
hrtimer.c
itimer.c
jiffies.c
Kconfig
Makefile
namespace.c
ntp_internal.h
ntp.c
posix-clock.c
posix-cpu-timers.c posix-cpu-timers: Fix rearm racing against process tick 2021-07-28 14:35:45 +02:00
posix-stubs.c
posix-timers.c
posix-timers.h
sched_clock.c
test_udelay.c
tick-broadcast-hrtimer.c
tick-broadcast.c
tick-common.c
tick-internal.h
tick-oneshot.c
tick-sched.c
tick-sched.h
time.c
timeconst.bc
timeconv.c
timecounter.c
timekeeping_debug.c
timekeeping_internal.h
timekeeping.c
timekeeping.h
timer_list.c
timer.c timers: Move clearing of base::timer_running under base:: Lock 2021-08-12 13:22:15 +02:00
vsyscall.c