From: Guenter Roeck <linux@roeck-us.net>
To: Steven Rostedt <rostedt@goodmis.org>
Cc: linux-kernel@vger.kernel.org,
Linus Torvalds <torvalds@linux-foundation.org>,
Thomas Gleixner <tglx@linutronix.de>,
Stephen Boyd <sboyd@kernel.org>,
Anna-Maria Gleixner <anna-maria@linutronix.de>,
Andrew Morton <akpm@linux-foundation.org>
Subject: Re: [PATCH v5a 0/5] timers: Use timer_shutdown*() before freeing timers
Date: Sun, 6 Nov 2022 09:08:11 -0800 [thread overview]
Message-ID: <20221106170811.GA105056@roeck-us.net> (raw)
In-Reply-To: <20221106054535.709068702@goodmis.org>
On Sun, Nov 06, 2022 at 01:45:35AM -0400, Steven Rostedt wrote:
>
> del_timer_sync() is often called before the object that owns the timer is
> freed. But sometimes there's a race that enables the timer again before it is
> freed and causes a use after free when that timer triggers. This patch set
> adds a new "shutdown" timer state, which is set on the new timer_shutdown()
> API. Once a timer is in this state, it can not be re-armed and if it is, it
> will warn.
>
> The first three patches change existing timer_shutdown() functions used
> locally in ARM and some drivers to better namespace names.
>
> The fourth patch implements the new API.
>
> The fifth patch is now a treewide patch that uses a coccinelle script to
> convert the trivial locations where a del_timer*() is called on a timer of an
> object that is freed immediately afterward (or at least in the same function).
>
Series looks good in my testbed.
Build results:
total: 152 pass: 152 fail: 0
Qemu test results:
total: 500 pass: 500 fail: 0
No runtime warnings reported.
For the series:
Tested-by: Guenter Roeck <linux@roeck-us.net>
Guenter
next prev parent reply other threads:[~2022-11-06 17:14 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-06 5:45 [PATCH v5a 0/5] timers: Use timer_shutdown*() before freeing timers Steven Rostedt
2022-11-06 5:45 ` [PATCH v5a 2/5] clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function Steven Rostedt
2022-11-06 11:09 ` Marc Zyngier
2022-11-07 11:03 ` Mark Rutland
2022-11-06 5:45 ` [PATCH v5a 3/5] clocksource/drivers/sp804: " Steven Rostedt
2022-11-06 5:45 ` [PATCH v5a 4/5] timers: Add timer_shutdown_sync() and timer_shutdown() to be called before freeing timers Steven Rostedt
2022-11-06 5:45 ` [PATCH v5a 5/5] treewide: Convert del_timer*() to timer_shutdown*() Steven Rostedt
2022-11-06 20:51 ` Linus Torvalds
2022-11-06 21:09 ` Steven Rostedt
2022-11-06 21:15 ` Guenter Roeck
2022-11-06 21:18 ` Steven Rostedt
2022-11-06 21:39 ` Linus Torvalds
2022-11-06 21:52 ` Steven Rostedt
2022-11-06 22:40 ` Linus Torvalds
2022-11-06 22:52 ` Guenter Roeck
2022-11-06 22:52 ` Steven Rostedt
2022-11-06 23:05 ` Linus Torvalds
2022-11-06 23:09 ` Julia Lawall
2022-11-06 23:08 ` Julia Lawall
2022-11-06 17:08 ` Guenter Roeck [this message]
2022-11-06 18:25 ` [PATCH v5a 0/5] timers: Use timer_shutdown*() before freeing timers Steven Rostedt
[not found] ` <20221106054648.367234222@goodmis.org>
2022-11-07 5:47 ` [PATCH v5a 1/5] ARM: spear: Do not use timer namespace for timer_shutdown() function Viresh Kumar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221106170811.GA105056@roeck-us.net \
--to=linux@roeck-us.net \
--cc=akpm@linux-foundation.org \
--cc=anna-maria@linutronix.de \
--cc=linux-kernel@vger.kernel.org \
--cc=rostedt@goodmis.org \
--cc=sboyd@kernel.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox