From: Ben Hutchings <ben@decadent.org.uk>
To: stable@vger.kernel.org
Cc: Lee Jones <lee.jones@linaro.org>,
"Luis Claudio R. Goncalves" <lgoncalv@redhat.com>,
Florian Fainelli <f.fainelli@gmail.com>
Subject: [PATCH 05/13] futex: Avoid freeing an active timer
Date: Sun, 28 Mar 2021 22:42:00 +0200 [thread overview]
Message-ID: <YGDqGB/tmAa2cjOz@decadent.org.uk> (raw)
In-Reply-To: <YGDp1qJOCUJmE1Ty@decadent.org.uk>
[-- Attachment #1: Type: text/plain, Size: 1931 bytes --]
From: Thomas Gleixner <tglx@linutronix.de>
commit 97181f9bd57405b879403763284537e27d46963d upstream.
Alexander reported a hrtimer debug_object splat:
ODEBUG: free active (active state 0) object type: hrtimer hint: hrtimer_wakeup (kernel/time/hrtimer.c:1423)
debug_object_free (lib/debugobjects.c:603)
destroy_hrtimer_on_stack (kernel/time/hrtimer.c:427)
futex_lock_pi (kernel/futex.c:2740)
do_futex (kernel/futex.c:3399)
SyS_futex (kernel/futex.c:3447 kernel/futex.c:3415)
do_syscall_64 (arch/x86/entry/common.c:284)
entry_SYSCALL64_slow_path (arch/x86/entry/entry_64.S:249)
Which was caused by commit:
cfafcd117da0 ("futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()")
... losing the hrtimer_cancel() in the shuffle. Where previously the
hrtimer_cancel() was done by rt_mutex_slowlock() we now need to do it
manually.
Reported-by: Alexander Levin <alexander.levin@verizon.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Fixes: cfafcd117da0 ("futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()")
Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1704101802370.2906@nanos
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/futex.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/futex.c b/kernel/futex.c
index 491888a89144..bd896f883ffd 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -3018,8 +3018,10 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
out_put_key:
put_futex_key(&q.key);
out:
- if (to)
+ if (to) {
+ hrtimer_cancel(&to->timer);
destroy_hrtimer_on_stack(&to->timer);
+ }
return ret != -EINTR ? ret : -ERESTARTNOINTR;
uaddr_faulted:
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
next prev parent reply other threads:[~2021-03-28 20:42 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-28 20:40 [PATCH 01/13] futex: Use smp_store_release() in mark_wake_futex() Ben Hutchings
2021-03-28 20:41 ` [PATCH 02/13] futex,rt_mutex: Introduce rt_mutex_init_waiter() Ben Hutchings
2021-03-28 20:41 ` [PATCH 03/13] futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock() Ben Hutchings
2021-03-28 20:41 ` [PATCH 04/13] futex: Drop hb->lock before enqueueing on the rtmutex Ben Hutchings
2021-03-28 20:42 ` Ben Hutchings [this message]
2021-03-28 20:42 ` [PATCH 06/13] futex,rt_mutex: Fix rt_mutex_cleanup_proxy_lock() Ben Hutchings
2021-03-28 20:42 ` [PATCH 07/13] futex: Handle early deadlock return correctly Ben Hutchings
2021-03-28 20:42 ` [PATCH 08/13] futex: Fix (possible) missed wakeup Ben Hutchings
2021-03-28 20:42 ` [PATCH 09/13] locking/futex: Allow low-level atomic operations to return -EAGAIN Ben Hutchings
2021-03-28 20:42 ` [PATCH 10/13] arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP Ben Hutchings
2021-03-28 20:42 ` [PATCH 11/13] futex: Prevent robust futex exit race Ben Hutchings
2021-03-28 20:43 ` [PATCH 12/13] futex: Fix incorrect should_fail_futex() handling Ben Hutchings
2021-03-28 20:43 ` [PATCH 13/13] futex: Handle transient "ownerless" rtmutex state correctly Ben Hutchings
2021-03-29 5:50 ` [PATCH 01/13] futex: Use smp_store_release() in mark_wake_futex() Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YGDqGB/tmAa2cjOz@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=f.fainelli@gmail.com \
--cc=lee.jones@linaro.org \
--cc=lgoncalv@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox