All of lore.kernel.org
 help / color / mirror / Atom feed
From: Thomas Gleixner <tglx@linutronix.de>
To: Surya Sai Madhu <suryasaimadhu369@gmail.com>
Cc: anna-maria@linutronix.de, frederic@kernel.org,
	peterz@infradead.org, mingo@redhat.com,
	linux-kernel@vger.kernel.org,
	Surya Sai Madhu <suryasaimadhu369@gmail.com>,
	syzbot+5e8dda76ca21dae314b6@syzkaller.appspotmail.com
Subject: Re: [PATCH] hrtimer: Fix missing debug object calls in in-place update path
Date: Fri, 19 Jun 2026 21:12:20 +0200	[thread overview]
Message-ID: <87bjd6cpkb.ffs@fw13> (raw)
In-Reply-To: <20260619131326.125730-1-suryasaimadhu369@gmail.com>

On Fri, Jun 19 2026 at 21:13, Surya Sai Madhu wrote:
> Commit 343f2f4dc542 ("hrtimer: Try to modify timers in place")
> introduced an optimization that updates the timer expiry in-place
> without dequeuing and re-enqueuing it when the new expiry falls
> within the range of neighbouring timers.
>
> However, the in-place path skips debug_hrtimer_deactivate() and
> debug_hrtimer_activate() calls, leaving the ODEBUG state machine
> out of sync. When ODEBUG subsequently sees the timer in an
> unexpected state, hrtimer_fixup_assert_init() fires and installs
> stub_timer() as the callback. When the timer then expires,
> stub_timer() hits WARN_ON(1) causing a kernel panic.

The debugobjects state of the timer is ACTIVE, otherwise it would not be
enqueued. hrtimer_fixup_assert_init() does not fire subsequently at
all. It is invoked on the first attempt to activate the non-initialized
timer and that is _before_ the timer was started the first time. See
hrtimer_start_range_ns() and hrtimer_start_range_ns_user().

So no, there is nothing out of sync and nothing to fix here. Your patch
is just a pointless exercise switching the debug objects state from
ACTIVE to INACTIVE and back to ACTIVE.

The real problem is somewhere else and has nothing to do with modify in
place.

Unfortunately the WARN() which is emitted by the debugobjects fixup
function, which also installs the stub_timer callback via
hrtimer_fixup_assert_init(), is not in the console log. That's puzzling.

Thanks,

        tglx



  reply	other threads:[~2026-06-19 19:12 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-06-19 13:13 [PATCH] hrtimer: Fix missing debug object calls in in-place update path Surya Sai Madhu
2026-06-19 19:12 ` Thomas Gleixner [this message]
  -- strict thread matches above, loose matches on Subject: below --
2026-06-19 13:10 suryasaimadhu
2026-06-19 13:01 suryasaimadhu
2026-06-19 12:59 suryasaimadhu
2026-06-19 12:57 suryasaimadhu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87bjd6cpkb.ffs@fw13 \
    --to=tglx@linutronix.de \
    --cc=anna-maria@linutronix.de \
    --cc=frederic@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=peterz@infradead.org \
    --cc=suryasaimadhu369@gmail.com \
    --cc=syzbot+5e8dda76ca21dae314b6@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.