From nobody Mon Jun 8 05:25:24 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 921EB378D77; Tue, 2 Jun 2026 19:30:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780428629; cv=none; b=W1a74FLaEmuv5XP9tMZ2/NCF98/CFKcudRgN8jV9mcUJTe40v4PR5kmLKzQK2nswNizY6CetulO1e2P33Ul8aCdQmcn24H4rD9m+wpxVso7yNjaYfYZXe2w3vSl3Bt9EVgZ+6deQkKRez2gVdJBpLeHCooA6oPiELwpsmkZmabw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780428629; c=relaxed/simple; bh=k+z+UegErKOgKc8Y9r5P8GZzq9pivmFBX6JGPHXAp+U=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=c6pb4lv9CmdM7PWLNhc0MfKTZRLcFrb6+4BcIxZpmd7nAVMoNX3Ga1/lWU+45lAwMX3qABJJ+IXIOij2BepSBzt8abQOMaDy/56BfrxgBEW2mtzgqp7J4sWI30CaspV8nT9J6iWEeGmjBTcFDtsotyZheF+3DHNVmP9o0jC3BPA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=YrDeD2aI; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=Gm+sx/lo; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="YrDeD2aI"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="Gm+sx/lo" Date: Tue, 02 Jun 2026 19:30:23 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1780428625; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ESKsHppUl0eXmDORp/K8ztSOYwLJdV3OgmFNzeFc3Ow=; b=YrDeD2aI8k1KBm67wGGNQIzHT2ijsSsXI3xvAKLBohl38G6DxgmdvQuixmzzDFnbuXM29B PKJ4QQkHH3nHWfWIhdpNXStBEUvIJexnNyoIezlqpzbKjCU4xSq6IeQv0JYmfwEnr04OOU Gh3XPxKdEhTZhUov8iOC4hu7Hmoe+jT+K1JrsNQjKwnZatg/6Z4IqCw+xcPL2g4TXZBHGt C4v5Jwr3VNCwNdn9vYZBmXPTl+5oaHtEyw20Zn58hHa4hy74DpfHKmjkWak7I9hC+8R3BL mFZsJFNcxfxFQUsUYtm9hopdCIs0tRROPUBTtbLGnISHevmX3Ekbuf/y9SAkRg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1780428625; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ESKsHppUl0eXmDORp/K8ztSOYwLJdV3OgmFNzeFc3Ow=; b=Gm+sx/loFJmFZPP8cO5PFy+m9d9vS6NQrQeVfxr4rfMXRPOPxMQ92xURn9MGMjYYLcNtmQ lqm3UjNoMy6EKrDA== From: "tip-bot2 for Frederic Weisbecker" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: timers/nohz] tick/sched: Fix TOCTOU in nohz idle time fetch Cc: Frederic Weisbecker , Thomas Gleixner , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20260508131647.43868-2-frederic@kernel.org> References: <20260508131647.43868-2-frederic@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <178042862372.710.16640993235785690427.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the timers/nohz branch of tip: Commit-ID: 86db4084b4b5d1a074bcc66c108a4c9d266812d4 Gitweb: https://git.kernel.org/tip/86db4084b4b5d1a074bcc66c108a4c9d2= 66812d4 Author: Frederic Weisbecker AuthorDate: Fri, 08 May 2026 15:16:33 +02:00 Committer: Thomas Gleixner CommitterDate: Tue, 02 Jun 2026 21:27:24 +02:00 tick/sched: Fix TOCTOU in nohz idle time fetch When the nohz idle time is fetched, the current clock timestamp is taken outside the seqcount, which can result in a race as reported by Sashiko: get_cpu_sleep_time_us() tick_nohz_start_idle() ----------------------- --------------------- now =3D ktime_get() write_seqcount_begin(idle_sleep= time_seq); idle_entrytime =3D ktime_get() tick_sched_flag_set(ts, TS_FLAG= _IDLE_ACTIVE); write_seqcount_end(&ts->idle_sl= eeptime_seq); read_seqcount_begin(idle_sleeptime_seq) delta =3D now - idle_entrytime); //!! But now < idle_entrytime idle =3D *sleeptime + delta; read_seqcount_retry(&ts->idle_sleeptime_seq, seq) Here the read side fetches the timestamp before the write side and its update. As a result the time delta computed on the read side is negative (ktime_t is signed) and breaks the cputime monotonicity guarantee. This could possibly be fixed with reading the current clock timestamp inside the seqcount but the reader overhead might then increase. Also simply checking that the current timestamp is above the idle entry time is enough to prevent any issue of the like. Fixes: 620a30fa0bd1 ("timers/nohz: Protect idle/iowait sleep time under seq= count") Reported-by: Sashiko Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260508131647.43868-2-frederic@kernel.org --- kernel/time/tick-sched.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c index cbbb87a..1713933 100644 --- a/kernel/time/tick-sched.c +++ b/kernel/time/tick-sched.c @@ -797,15 +797,16 @@ static u64 get_cpu_sleep_time_us(struct tick_sched *t= s, ktime_t *sleeptime, *last_update_time =3D ktime_to_us(now); =20 do { + ktime_t delta =3D 0; + seq =3D read_seqcount_begin(&ts->idle_sleeptime_seq); =20 if (tick_sched_flag_test(ts, TS_FLAG_IDLE_ACTIVE) && compute_delta) { - ktime_t delta =3D ktime_sub(now, ts->idle_entrytime); - - idle =3D ktime_add(*sleeptime, delta); - } else { - idle =3D *sleeptime; + if (now > ts->idle_entrytime) + delta =3D ktime_sub(now, ts->idle_entrytime); } + + idle =3D ktime_add(*sleeptime, delta); } while (read_seqcount_retry(&ts->idle_sleeptime_seq, seq)); =20 return ktime_to_us(idle);