[PATCH] posix-timers: fix IRQ state handling in posix_timer_delete()

[PATCH] posix-timers: fix IRQ state handling in posix_timer_delete()

[pavankumaryalagada]

From: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>

exit_itimers() uses a spinlock_irq guard for timer->it_lock, which
maintains counted IRQ-disable state. However, posix_timer_delete()
temporarily releases and reacquires the lock with spin_unlock_irq()
and spin_lock_irq(), which do not maintain the same IRQ-disable state
while timer_wait_running() may sleep.

Use spin_unlock_irq_enable() and spin_lock_irq_disable() for the
temporary lock handoff to keep the IRQ-disable state balanced.

Reported-by: syzbot+143e0859898751aa8f94@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=143e0859898751aa8f94
Tested-by: syzbot+143e0859898751aa8f94@syzkaller.appspotmail.com
Signed-off-by: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
---
 kernel/time/posix-timers.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index 436ba794cc0b..5e580b4223de 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -1057,9 +1057,9 @@ static void posix_timer_delete(struct k_itimer *timer)
 
 	while (timer->kclock->timer_del(timer) == TIMER_RETRY) {
 		guard(rcu)();
-		spin_unlock_irq(&timer->it_lock);
+		spin_unlock_irq_enable(&timer->it_lock);
 		timer_wait_running(timer);
-		spin_lock_irq(&timer->it_lock);
+		spin_lock_irq_disable(&timer->it_lock);
 	}
 }
 
-- 
2.43.0

Re: [PATCH] posix-timers: fix IRQ state handling in posix_timer_delete()

[Thomas Gleixner]

On Wed, Aug 26 2026 at 01:36, pavankumaryalagada@gmail.com wrote:
> From: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
>
> exit_itimers() uses a spinlock_irq guard for timer->it_lock, which
> maintains counted IRQ-disable state. However, posix_timer_delete()
> temporarily releases and reacquires the lock with spin_unlock_irq()
> and spin_lock_irq(), which do not maintain the same IRQ-disable state
> while timer_wait_running() may sleep.
>
> Use spin_unlock_irq_enable() and spin_lock_irq_disable() for the
> temporary lock handoff to keep the IRQ-disable state balanced.
>
> Reported-by: syzbot+143e0859898751aa8f94@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=143e0859898751aa8f94
> Tested-by: syzbot+143e0859898751aa8f94@syzkaller.appspotmail.com
> Signed-off-by: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>

This clearly lacks a "Fixes:" tag and you failed to actually CC the
relevant people, but see below.

> ---
>  kernel/time/posix-timers.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
> index 436ba794cc0b..5e580b4223de 100644
> --- a/kernel/time/posix-timers.c
> +++ b/kernel/time/posix-timers.c
> @@ -1057,9 +1057,9 @@ static void posix_timer_delete(struct k_itimer *timer)
>  
>  	while (timer->kclock->timer_del(timer) == TIMER_RETRY) {
>  		guard(rcu)();
> -		spin_unlock_irq(&timer->it_lock);
> +		spin_unlock_irq_enable(&timer->it_lock);
>  		timer_wait_running(timer);
> -		spin_lock_irq(&timer->it_lock);
> +		spin_lock_irq_disable(&timer->it_lock);
>  	}
>  }

While this is curing the symptom, it's not fixing the root cause. The
root cause is that the conversion of just the lock guards does not cut
it. This particular case in posix_timer_delete() is just the tip of the
iceberg and an easy one to trigger. The whole conversion is not really
well thought out and lacks any form of static analysis. Therefore the
actual culprit got reverted and will hit Linus tree soon:

  https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?h=locking/urgent

Thanks,

        tglx