| commit | f13d4f979c518119bba5439dd2364d76d31dcd3f | [log] [tgz] |
|---|---|---|
| author | Salman Qazi <sqazi@google.com> | Tue Oct 12 07:25:19 2010 -0700 |
| committer | Thomas Gleixner <tglx@linutronix.de> | Thu Oct 14 13:29:59 2010 +0200 |
| tree | 952be8d19f13a3f0942c67c1f0d400d8dab472ea | |
| parent | 53eeb64e808971207350386121f4bab12fa2f45f [diff] |
hrtimer: Preserve timer state in remove_hrtimer()
The race is described as follows:
CPU X CPU Y
remove_hrtimer
// state & QUEUED == 0
timer->state = CALLBACK
unlock timer base
timer->f(n) //very long
hrtimer_start
lock timer base
remove_hrtimer // no effect
hrtimer_enqueue
timer->state = CALLBACK |
QUEUED
unlock timer base
hrtimer_start
lock timer base
remove_hrtimer
mode = INACTIVE
// CALLBACK bit lost!
switch_hrtimer_base
CALLBACK bit not set:
timer->base
changes to a
different CPU.
lock this CPU's timer base
The bug was introduced with commit ca109491f (hrtimer: removing all ur
callback modes) in 2.6.29
[ tglx: Feed new state via local variable and add a comment. ]
Signed-off-by: Salman Qazi <sqazi@google.com>
Cc: akpm@linux-foundation.org
Cc: Peter Zijlstra <peterz@infradead.org>
LKML-Reference: <20101012142351.8485.21823.stgit@dungbeetle.mtv.corp.google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@kernel.org