Re: [PATCH 0/4] Fix forward()/expires() racing with concurrent arming

[FUJITA Tomonori <tomo@flapping.org>]

On Thu, 13 Aug 2026 15:16:38 +0100
"Gary Guo" <gary@garyguo.net> wrote:

> On Thu Aug 13, 2026 at 2:48 PM BST, FUJITA Tomonori wrote:
>> From: FUJITA Tomonori <fujita.tomonori@gmail.com>
>>
>> This series started from the review of patches 3 and 4 [1]: a hrtimer
>> can be armed from any CPU at any time, including while its callback
>> runs, so restricting HrTimer::expires() to the callback context is not
>> by itself enough to remove the race.
>>
>> It turned out that expires() is not the only problem. A callback may
>> also change its expiry time with hrtimer_forward(), which is sound
>> only because __run_hrtimer() dequeues the timer for the duration of
>> the callback. Arming the same timer from another CPU puts it back into
>> the rbtree while the callback runs, so hrtimer_forward() then changes
>> the expiry of a timer that is queued, without the base lock and
>> without re-checking the ordering, which leaves the tree unsorted.
>>
>> Two of the four pointer types cannot construct that
>> situation. Starting a Pin<Box<T, A>> moves the box into the handle,
>> and starting a Pin<&mut T> consumes the exclusive borrow, so in both
>> cases nothing is left to arm the timer with. Arc<T> is Clone and
>> Pin<&T> is Copy, and both of their start functions are reachable from
>> safe code, so safe Rust could arm a timer whose callback was running.
>>
>> "No arming while the callback runs" cannot be expressed in the type
>> system, because the callback begins when the timer expires rather than
>> at any point in the Rust program, so patches 1 and 2 use the stronger
>> "no arming while armed" instead. hrtimer_cancel() waits for the
>> handler to return, which makes that the point where the right to arm
>> can be handed back. The right to arm is split out of Arc<T> into
>> HrTimerArc<T> and out of Pin<&T> into HrTimerPin<'a, T>, both
>> non-clonable and consumed by start, modelled on ListArc; the object
>> itself stays shareable through plain Arc references and shared pinned
>> references respectively.
>>
>> Patches 3 and 4 are the previously posted expires() and
>> repr(transparent) patches, unchanged. With patches 1 and 2 in place,
>> the callback context has no concurrent writer of node.expires. So
>> HrTimerCallbackContext::expires() is sound.
> 
> I am thinking about this and I wonder about a different approach: the only
> reason that we're having this issue, is that `expires()` call and
> `forward`/`forward_now` is executed outside the protection of the base lock.
> 
> The fix is easy -- to ensure that they are executed with the base lock held.
> The callback wants either:
> * Do not restart the timer
> * Call hrtimer_forward[_now] and restart the timer
> 
> So, if we change the order from
> 
>     unlock base
>     restart = fn(timer)
>     lock base
>     if restart {
>         queue
>     }
> 
> to
> 
>     get expires
>     unlock base
>     restart = fn(timer, expires)
>     lock base
>     match restart {
>         Restart(now, interval) => {
>             hrtimer_forward(timer, now, interval);
>             queue
>         }
>         NoRestart => (),
>     }
> 
> then we completely eradicate this issue.

If I understood the proposal correctly: hrtimer_forward[_now]() would no
longer be called by drivers at all. It becomes internal to the core and
runs with the base lock held, and every hrtimer callback in the tree is
updated to take the expiry as an argument and return the interval, with
the ones that use the overrun computing it from what they were passed.

That could remove the need for the rule on the Rust side.

Anna-Maria, Frederic, Thomas: does this direction look reasonable to you?


> Alternatively, we can add another spinlock to protect `expires` from race
> condition from within callback and concurrent restart -- that is what perf core
> does: perf_mux_hrtimer_handler and perf_mux_hrtimer_restart uses the same
> hrtimer_lock to prevent race.

Right, with the lock and cpc->hrtimer_active flag together, perf
implements the same "do not arm while armed" rule that these patches
implement in the type system.


> But further complicating the type system to prevent concurrent restart sounds
> like a bad approach to me.

My intent is the opposite: I think this makes the design simpler.

All four implementations of start() already take self by value. For
Pin<Box<T, A>> and Pin<&mut T> that means what it says -- the box is moved
into the handle, the exclusive borrow is consumed -- so "no arming while
armed" is already the design there. For Arc<T> and Pin<&T> the same
signature meant nothing, because Clone and Copy let you build another
pointer and call start() again.

So the contract depended on which pointer type you picked, and the module
documentation had to spell that out: "When a type implements both
HrTimerPointer and Clone, it is possible to issue the start operation
while the timer is in the started state." After the series there is one
rule for all four types, and that paragraph is gone together with the
restart operation it described.