hrtimer: Preserve timer state in remove_hrtimer()
authorSalman Qazi <sqazi@google.com>
Tue, 12 Oct 2010 14:25:19 +0000 (07:25 -0700)
committerThomas Gleixner <tglx@linutronix.de>
Thu, 14 Oct 2010 11:29:59 +0000 (13:29 +0200)
commitf13d4f979c518119bba5439dd2364d76d31dcd3f
tree952be8d19f13a3f0942c67c1f0d400d8dab472ea
parent53eeb64e808971207350386121f4bab12fa2f45f
hrtimer: Preserve timer state in remove_hrtimer()

The race is described as follows:

CPU X                                 CPU Y
remove_hrtimer
// state & QUEUED == 0
timer->state = CALLBACK
unlock timer base
timer->f(n) //very long
                                  hrtimer_start
                                    lock timer base
                                    remove_hrtimer // no effect
                                    hrtimer_enqueue
                                    timer->state = CALLBACK |
                                                   QUEUED
                                    unlock timer base
                                  hrtimer_start
                                    lock timer base
                                    remove_hrtimer
                                        mode = INACTIVE
                                        // CALLBACK bit lost!
                                    switch_hrtimer_base
                                            CALLBACK bit not set:
                                                    timer->base
                                                    changes to a
                                                    different CPU.
lock this CPU's timer base

The bug was introduced with commit ca109491f (hrtimer: removing all ur
callback modes) in 2.6.29

[ tglx: Feed new state via local variable and add a comment. ]

Signed-off-by: Salman Qazi <sqazi@google.com>
Cc: akpm@linux-foundation.org
Cc: Peter Zijlstra <peterz@infradead.org>
LKML-Reference: <20101012142351.8485.21823.stgit@dungbeetle.mtv.corp.google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@kernel.org
kernel/hrtimer.c