Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753016AbbHRNhI (ORCPT ); Tue, 18 Aug 2015 09:37:08 -0400 Received: from terminus.zytor.com ([198.137.202.10]:36744 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751690AbbHRNhG (ORCPT ); Tue, 18 Aug 2015 09:37:06 -0400 Date: Tue, 18 Aug 2015 06:36:42 -0700 From: tip-bot for Eric Dumazet Message-ID: Cc: linux@eikelenboom.it, davem@davemloft.net, hpa@zytor.com, tglx@linutronix.de, edumazet@google.com, linux-kernel@vger.kernel.org, mingo@kernel.org, jon@jons.org Reply-To: tglx@linutronix.de, linux@eikelenboom.it, davem@davemloft.net, hpa@zytor.com, linux-kernel@vger.kernel.org, mingo@kernel.org, jon@jons.org, edumazet@google.com In-Reply-To: <1439831928.32680.11.camel@edumazet-glaptop2.roam.corp.google.com> References: <1439831928.32680.11.camel@edumazet-glaptop2.roam.corp.google.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:timers/urgent] timer: Write timer->flags atomically Git-Commit-ID: d0023a1448abdcc892b8bca631e74bb1888efd02 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2324 Lines: 61 Commit-ID: d0023a1448abdcc892b8bca631e74bb1888efd02 Gitweb: http://git.kernel.org/tip/d0023a1448abdcc892b8bca631e74bb1888efd02 Author: Eric Dumazet AuthorDate: Mon, 17 Aug 2015 10:18:48 -0700 Committer: Thomas Gleixner CommitDate: Tue, 18 Aug 2015 15:31:16 +0200 timer: Write timer->flags atomically lock_timer_base() cannot prevent the following : CPU1 ( in __mod_timer() timer->flags |= TIMER_MIGRATING; spin_unlock(&base->lock); base = new_base; spin_lock(&base->lock); // The next line clears TIMER_MIGRATING timer->flags &= ~TIMER_BASEMASK; CPU2 (in lock_timer_base()) see timer base is cpu0 base spin_lock_irqsave(&base->lock, *flags); if (timer->flags == tf) return base; // oops, wrong base timer->flags |= base->cpu // too late We must write timer->flags in one go, otherwise we can fool other cpus. Fixes: bc7a34b8b9eb ("timer: Reduce timer migration overhead if disabled") Signed-off-by: Eric Dumazet Cc: Jon Christopherson Cc: David Miller Cc: xen-devel@lists.xen.org Cc: david.vrabel@citrix.com Cc: Sander Eikelenboom Link: http://lkml.kernel.org/r/1439831928.32680.11.camel@edumazet-glaptop2.roam.corp.google.com Signed-off-by: Thomas Gleixner Cc: Thomas Gleixner --- kernel/time/timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/time/timer.c b/kernel/time/timer.c index 5e097fa..84190f0 100644 --- a/kernel/time/timer.c +++ b/kernel/time/timer.c @@ -807,8 +807,8 @@ __mod_timer(struct timer_list *timer, unsigned long expires, spin_unlock(&base->lock); base = new_base; spin_lock(&base->lock); - timer->flags &= ~TIMER_BASEMASK; - timer->flags |= base->cpu; + WRITE_ONCE(timer->flags, + (timer->flags & ~TIMER_BASEMASK) | base->cpu); } } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/