From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B0B8C77B73 for ; Tue, 25 Apr 2023 18:49:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234696AbjDYStM (ORCPT ); Tue, 25 Apr 2023 14:49:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44604 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234673AbjDYStG (ORCPT ); Tue, 25 Apr 2023 14:49:06 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6C77216F2A for ; Tue, 25 Apr 2023 11:48:59 -0700 (PDT) Message-ID: <20230425183312.862346341@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448537; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=gYiHlRz0OuPVt4oauTqBjN/lQMg3nN/+xtqOB9QDFLM=; b=aqcvRFatWKA1jUrTiFWkwr0WYWB/qsrXbVkKW/GKowlhruGLnx28U6sXceSZWrgseV2bSs HAKdLpi3VH82mU1mcJqsph9GSEEZC1foLE0AO3fWCRXIyLnNr5U9rTUM1XQ7rwsy6JLY8V otBItxu9Iyl94fORNDZmbwFwb+5j/v/DLnY+QQV+4EG1nnc9I0FhiqsnnNeYt9zXAD5Xaz Z8m3V7BJhcmjV1G1BUAYR5lPF2TuAHGDATus9lTnaq9PZjqvHewfhdcbEuaGU6wAJhKwRk 8WjkEcqs7U3HLmfsmX+zXaJPjxdREDSvZoBBqW4AJs9AbL3oNlYfm+cpLNhHdA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448537; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=gYiHlRz0OuPVt4oauTqBjN/lQMg3nN/+xtqOB9QDFLM=; b=SJZ5cGBxyiarbsIRTK7MtaJ1euTQ5JFdAatIvEPnJ6q2pZ7FXUOEQo3TworOoicsK4Logo N4IGTgnNBbUgcQDA== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 01/20] posix-timers: Prevent RT livelock in itimer_delete() References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:48:56 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" itimer_delete() has a retry loop when the timer is concurrently expired. On non-RT kernels this just spin-waits until the timer callback has completed. On RT kernels this is a potential livelock when the exiting task preempted the hrtimer soft interrupt. This only affects hrtimer based timers as Posix CPU timers cannot be concurrently expired. For CONFIG_POSIX_CPU_TIMERS_TASK_WORK=3Dy this is obviously impossible as the task cannot run task work and exit at the same time. The CONFIG_POSIX_CPU_TIMERS_TASK_WORK=3Dn (only non-RT) is prevented because interrupts are disabled. Replace spin_unlock() with an invocation of timer_wait_running() to handle it the same way as the other retry loops in the posix timer code. Fixes: ec8f954a40da ("posix-timers: Use a callback for cancel synchronizati= on on PREEMPT_RT") Signed-off-by: Thomas Gleixner Cc: Sebastian Siewior --- kernel/time/posix-timers.c | 50 +++++++++++++++++++++++++++++++++++++---= ----- 1 file changed, 42 insertions(+), 8 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -1037,27 +1037,59 @@ SYSCALL_DEFINE1(timer_delete, timer_t, t } =20 /* - * return timer owned by the process, used by exit_itimers + * Delete a timer if it is armed, remove it from the hash and schedule it + * for RCU freeing. */ static void itimer_delete(struct k_itimer *timer) { -retry_delete: - spin_lock_irq(&timer->it_lock); + unsigned long flags; =20 +retry_delete: + /* + * irqsave is required to make timer_wait_running() work. + */ + spin_lock_irqsave(&timer->it_lock, flags); + + /* + * Even if the timer is not longer accessible from other tasks + * it still might be armed and queued in the underlying timer + * mechanism. Worse, that timer mechanism might run the expiry + * function concurrently. + */ if (timer_delete_hook(timer) =3D=3D TIMER_RETRY) { - spin_unlock_irq(&timer->it_lock); + /* + * Timer is expired concurrently, prevent livelocks + * and pointless spinning on RT. + * + * The CONFIG_POSIX_CPU_TIMERS_TASK_WORK=3Dy case is + * irrelevant here because obviously the exiting task + * cannot be expiring timer in task work concurrently. + * Ditto for CONFIG_POSIX_CPU_TIMERS_TASK_WORK=3Dn as the + * tick interrupt cannot run on this CPU because the above + * spin_lock disabled interrupts. + * + * timer_wait_running() drops timer::it_lock, which opens + * the possibility for another task to delete the timer. + * + * That's not possible here because this is invoked from + * do_exit() only for the last thread of the thread group. + * So no other task can access that timer. + */ + if (WARN_ON_ONCE(timer_wait_running(timer, &flags) !=3D timer)) + return; + goto retry_delete; } list_del(&timer->list); =20 - spin_unlock_irq(&timer->it_lock); + spin_unlock_irqrestore(&timer->it_lock, flags); release_posix_timer(timer, IT_ID_SET); } =20 /* - * This is called by do_exit or de_thread, only when nobody else can - * modify the signal->posix_timers list. Yet we need sighand->siglock - * to prevent the race with /proc/pid/timers. + * Invoked from do_exit() when the last thread of a thread group exits. + * At that point no other task can access the timers of the dying + * task anymore. */ void exit_itimers(struct task_struct *tsk) { @@ -1067,10 +1099,12 @@ void exit_itimers(struct task_struct *ts if (list_empty(&tsk->signal->posix_timers)) return; =20 + /* Protect against concurrent read via /proc/$PID/timers */ spin_lock_irq(&tsk->sighand->siglock); list_replace_init(&tsk->signal->posix_timers, &timers); spin_unlock_irq(&tsk->sighand->siglock); =20 + /* The timers are not longer accessible via tsk::signal */ while (!list_empty(&timers)) { tmr =3D list_first_entry(&timers, struct k_itimer, list); itimer_delete(tmr); From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 87F40C6FD18 for ; Tue, 25 Apr 2023 18:49:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234729AbjDYStP (ORCPT ); Tue, 25 Apr 2023 14:49:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44658 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234679AbjDYStG (ORCPT ); Tue, 25 Apr 2023 14:49:06 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 800BE16F3C for ; Tue, 25 Apr 2023 11:49:00 -0700 (PDT) Message-ID: <20230425183312.932345089@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448539; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=ma15CcBtPBAO08sKCc2bZL60SF+cskQ6NkR0WFr8uz4=; b=wXqXLZK0I9S1eIVXdIW73RV90sJQGz+JCRCrczABAACivcLflQxHoUpEMchlSc1f5ROQ6/ PCa45iAF2VdtMYjV40MAbKsBITKjz1FGH61BNwMudqo5aesOxVGGo/VUt3Kt1tsEvh3x7y no6HKxjnr2njW6V1W/ElACb3cmotfqKznm28lI6zeK0d5FJChkY2kK4jjqMVDQGM8d8V/x 8WckZ/mUJ2xDUfFw/BT8TIHN8vujJURTILNMUlHnRchFhGPoXjhHihaU77MYDDuBZON55k rNyitzkSBXmE3DiWabte4FJQ/0UPhRyco4TElk4/vwA3CBOrwMWXcIdOf4a80A== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448539; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=ma15CcBtPBAO08sKCc2bZL60SF+cskQ6NkR0WFr8uz4=; b=qoln3u/jsJxr2/gaQYE10qZLx/DDjeDSwFMjMKBCngltWOrSa+H1Ux1/vC+YlJTtND1ZQJ R/9J3lKVyanqYADw== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Sebastian Siewior , Michael Kerrisk Subject: [patch 02/20] posix-timers: Ensure timer ID search-loop limit is valid References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:48:58 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" posix_timer_add() tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation. This is done in a loop searching the ID space for a free slot one by one. The loop has to terminate when the search wrapped around to the starting point. But that's racy vs. establishing the starting point. That is read out lockless, which leads to the following problem: CPU0 CPU1 posix_timer_add() start =3D sig->posix_timer_id; lock(hash_lock); ... posix_timer_add() if (++sig->posix_timer_id < 0) start =3D sig->posix_timer_id; sig->posix_timer_id =3D 0; So CPU1 can observe a negative start value, i.e. -1, and the loop break never happens because the condition can never be true: if (sig->posix_timer_id =3D=3D start) break; While this is unlikely to ever turn into an endless loop as the ID space is huge (INT_MAX), the racy read of the start value caught the attention of KCSAN and Dmitry unearthed that incorrectness. Rewrite it so that the start condition can never observe the negative value and annotate the read and the write with READ_ONCE()/WRITE_ONCE(). Reported-by: syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com Reported-by: Dmitry Vyukov Signed-off-by: Thomas Gleixner --- include/linux/sched/signal.h | 2 +- kernel/time/posix-timers.c | 30 +++++++++++++++++------------- 2 files changed, 18 insertions(+), 14 deletions(-) --- a/include/linux/sched/signal.h +++ b/include/linux/sched/signal.h @@ -135,7 +135,7 @@ struct signal_struct { #ifdef CONFIG_POSIX_TIMERS =20 /* POSIX.1b Interval Timers */ - int posix_timer_id; + unsigned int next_posix_timer_id; struct list_head posix_timers; =20 /* ITIMER_REAL timer for the process */ --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -140,25 +140,29 @@ static struct k_itimer *posix_timer_by_i static int posix_timer_add(struct k_itimer *timer) { struct signal_struct *sig =3D current->signal; - int first_free_id =3D sig->posix_timer_id; struct hlist_head *head; - int ret =3D -ENOENT; + unsigned int start, id; =20 - do { + /* Can be written by a different task concurrently in the loop below */ + start =3D READ_ONCE(sig->next_posix_timer_id); + + for (id =3D ~start; start !=3D id; id++) { spin_lock(&hash_lock); - head =3D &posix_timers_hashtable[hash(sig, sig->posix_timer_id)]; - if (!__posix_timers_find(head, sig, sig->posix_timer_id)) { + id =3D sig->next_posix_timer_id; + + /* Write the next ID back. Clamp it to the positive space */ + WRITE_ONCE(sig->next_posix_timer_id, (id + 1) & INT_MAX); + + head =3D &posix_timers_hashtable[hash(sig, id)]; + if (!__posix_timers_find(head, sig, id)) { hlist_add_head_rcu(&timer->t_hash, head); - ret =3D sig->posix_timer_id; + spin_unlock(&hash_lock); + return id; } - if (++sig->posix_timer_id < 0) - sig->posix_timer_id =3D 0; - if ((sig->posix_timer_id =3D=3D first_free_id) && (ret =3D=3D -ENOENT)) - /* Loop over all possible ids completed */ - ret =3D -EAGAIN; spin_unlock(&hash_lock); - } while (ret =3D=3D -ENOENT); - return ret; + } + /* POSIX return code when no timer ID could be allocated */ + return -EAGAIN; } =20 static inline void unlock_timer(struct k_itimer *timr, unsigned long flags) From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9E0ACC6FD18 for ; Tue, 25 Apr 2023 18:49:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234737AbjDYStS (ORCPT ); Tue, 25 Apr 2023 14:49:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44630 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234688AbjDYStI (ORCPT ); Tue, 25 Apr 2023 14:49:08 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 189AD16F3D for ; Tue, 25 Apr 2023 11:49:02 -0700 (PDT) Message-ID: <20230425183312.985681995@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448540; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=q6yQSMh5NftPeZgPAUvdDD7ZWt6JAf5f2/3w3UhJ70Q=; b=YFqFZlAfXnLvCdWhP63tL7EqJG01euEvWnXMKyZ4fWLintzWYtQlDrz4x1F3Le+A34Eu/S bEX9uXMigiFk+vTmiWsSTAgJVTghexsnMwawy/0Bx6Dy4xKuxOtZJvZXnCILC7l25yb3Up 903ETpG3x3NpT6Cc8ue9GhAyXo1/CWzJVI3eup3kQucU0TYY5qxUwcMl8+h5omMXk0ToOp OoPbtFqFebZWIzfMIlGAtYbdsA7NEglKqS563SzLDghA/a3CTk1B/NEuqFl+Q+YykxsmJq TU+ouYWxJ7GEP6381AnkoR6Lk5W41pEU0kDLQAwW9YZyrXsZFpGV5WYxmrOgog== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448540; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=q6yQSMh5NftPeZgPAUvdDD7ZWt6JAf5f2/3w3UhJ70Q=; b=mDOvRu4hOE3asu9/pisMKyXQeVXK2GPXNrCGQlnPFD3m0O4j1dO4Z5wx4QztID7kjjCE6/ K7mtYEnp2qE3OrAQ== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 03/20] posix-timers: Clarify timer_wait_running() comment References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:00 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Explain it better and add the CONFIG_POSIX_CPU_TIMERS_TASK_WORK=3Dy aspect for completeness. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -835,10 +835,18 @@ static void common_timer_wait_running(st } =20 /* - * On PREEMPT_RT this prevent priority inversion against softirq kthread in - * case it gets preempted while executing a timer callback. See comments in - * hrtimer_cancel_wait_running. For PREEMPT_RT=3Dn this just results in a - * cpu_relax(). + * On PREEMPT_RT this prevents priority inversion and a potential livelock + * against the ksoftirqd thread in case that ksoftirqd gets preempted while + * executing a hrtimer callback. + * + * See the comments in hrtimer_cancel_wait_running(). For PREEMPT_RT=3Dn t= his + * just results in a cpu_relax(). + * + * For POSIX CPU timers with CONFIG_POSIX_CPU_TIMERS_TASK_WORK=3Dn this is + * just a cpu_relax(). With CONFIG_POSIX_CPU_TIMERS_TASK_WORK=3Dy this + * prevents spinning on an eventually scheduled out task and a livelock + * when the task which tries to delete or disarm the timer has preempted + * the task which runs the expiry in task work context. */ static struct k_itimer *timer_wait_running(struct k_itimer *timer, unsigned long *flags) From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59D16C77B61 for ; Tue, 25 Apr 2023 18:49:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234755AbjDYStU (ORCPT ); Tue, 25 Apr 2023 14:49:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44656 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234693AbjDYStI (ORCPT ); Tue, 25 Apr 2023 14:49:08 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A638916F37 for ; Tue, 25 Apr 2023 11:49:03 -0700 (PDT) Message-ID: <20230425183313.038444551@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448542; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=sVsp5iAcrwxZBIrimSxBovV+M8RO8rU2VAcGB3fBiwg=; b=PCa5afvfvzY72u9eR4fiO0w2I8nAar7gB/x7UavqUI0iYMcJPI7IXO0ovNOgK9cfLOvMMq 1+BTaIx9uMF2Gm+tliGSaJi+fkD0IMvavt2Jezswr5aJbZaI/6HWR249IovyQvhcIH70EF j6LdQGfZfvkFId6obyKy4/21gmO+S+31Z3wwgPEA8o9yt2KwDwr46dcHE8c4Ye5+FXOCXv eYiTGoe65UvQMb0kzL5VSR+JZ2I8x78nvX2yPIr9LiApXo5spGZqdmlEqpQYiknG36NY79 JAXcOruEzimbUog6x6LR4NWwLczxBZ7WsuHqtr4IFYAJi57+aOrH7IyArJaibw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448542; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=sVsp5iAcrwxZBIrimSxBovV+M8RO8rU2VAcGB3fBiwg=; b=uv++84Hxg7ky5/7UmzfIOgCn4aivjVTP1XJV0etONmsK8sJlc3ApL4pQgS+2KoXXo8duoi nD8UDE5LgeNZrLCQ== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 04/20] posix-timers: Cleanup comments about timer ID tracking References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:01 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Describe the hash table properly and remove the IDR leftover comments. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 28 ++++++++-------------------- 1 file changed, 8 insertions(+), 20 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -35,20 +35,17 @@ #include "timekeeping.h" #include "posix-timers.h" =20 -/* - * Management arrays for POSIX timers. Timers are now kept in static hash = table - * with 512 entries. - * Timer ids are allocated by local routine, which selects proper hash hea= d by - * key, constructed from current->signal address and per signal struct cou= nter. - * This keeps timer ids unique per process, but now they can intersect bet= ween - * processes. - */ +static struct kmem_cache *posix_timers_cache; =20 /* - * Lets keep our timers in a slab cache :-) + * Timers are managed in a hash table for lockless lookup. The hash key is + * constructed from current::signal and the timer ID and the timer is + * matched against current::signal and the timer ID when walking the hash + * bucket list. + * + * This allows checkpoint/restore to reconstruct the exact timer IDs for + * a process. */ -static struct kmem_cache *posix_timers_cache; - static DEFINE_HASHTABLE(posix_timers_hashtable, 9); static DEFINE_SPINLOCK(hash_lock); =20 @@ -66,15 +63,6 @@ static const struct k_clock clock_realti #endif =20 /* - * The timer ID is turned into a timer address by idr_find(). - * Verifying a valid ID consists of: - * - * a) checking that idr_find() returns other than -1. - * b) checking that the timer id matches the one in the timer itself. - * c) that the timer owner is in the callers thread group. - */ - -/* * CLOCKs: The POSIX standard calls for a couple of clocks and allows us * to implement others. This structure defines the various * clocks. From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 595D1C77B61 for ; Tue, 25 Apr 2023 18:49:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234777AbjDYSt0 (ORCPT ); Tue, 25 Apr 2023 14:49:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44762 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234678AbjDYStL (ORCPT ); Tue, 25 Apr 2023 14:49:11 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6EF0C17A11 for ; Tue, 25 Apr 2023 11:49:06 -0700 (PDT) Message-ID: <20230425183313.091081515@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448543; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=7wcpMIbw4++5yEH81pAF+D9HvfAN0jWN9VmY7vCAJ2o=; b=3SzKiJcI84fHv6hDMwDFKj0dz+kgbttCLXlYgFOecKZJRDmMi0szOZUvy7KBF2j3Lg6yd0 9KpLFScLvHwdT32fNzlqriqAfZtE+Jgf0SvhRakPY6eiILupjzmzoqtzYCqScnXZVD2UXn Rq9aZxTxE282mdxWUDCRtIn0oUaCcSGQf8BdhqVv9l7B5LE4uh7RCapG9WvIWcDv7e0eFS JOGPTLFyY304//XVIgQkKhnrPiNcxwri6bPzJpb5050SNcD30D9k0QDLbndUQzexS+UfB4 PW0BPEg4NXc8LGkCrEneDEnnY12Kq6R6hm8rEzj64wyGX8LIWxsGdqwPSUPGoA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448543; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=7wcpMIbw4++5yEH81pAF+D9HvfAN0jWN9VmY7vCAJ2o=; b=HU8bN7oO/c3cRXOmyVwL3LsFBo7MIrj2HiMwOpW6jqc7Szcr+61weSetUiD5ShUTjSSpIu nv+Jql9+XcLBmpBg== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 05/20] posix-timers: Add comments about timer lookup References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:03 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Document how the timer ID validation in the hash table works. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 39 ++++++++++++++++++++++++++++++++------- 1 file changed, 32 insertions(+), 7 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -505,6 +505,12 @@ static int do_timer_create(clockid_t whi return -EAGAIN; =20 spin_lock_init(&new_timer->it_lock); + + /* + * Add the timer to the hash table. The timer is not yet valid + * because new_timer::it_signal is still NULL. The timer id is also + * not yet visible to user space. + */ new_timer_id =3D posix_timer_add(new_timer); if (new_timer_id < 0) { error =3D new_timer_id; @@ -550,6 +556,7 @@ static int do_timer_create(clockid_t whi goto out; =20 spin_lock_irq(¤t->sighand->siglock); + /* This makes the timer valid in the hash table */ new_timer->it_signal =3D current->signal; list_add(&new_timer->list, ¤t->signal->posix_timers); spin_unlock_irq(¤t->sighand->siglock); @@ -596,13 +603,6 @@ COMPAT_SYSCALL_DEFINE3(timer_create, clo } #endif =20 -/* - * Locking issues: We need to protect the result of the id look up until - * we get the timer locked down so it is not deleted under us. The - * removal is done under the idr spinlock so we use that here to bridge - * the find to the timer lock. To avoid a dead lock, the timer id MUST - * be release with out holding the timer lock. - */ static struct k_itimer *__lock_timer(timer_t timer_id, unsigned long *flag= s) { struct k_itimer *timr; @@ -614,10 +614,35 @@ static struct k_itimer *__lock_timer(tim if ((unsigned long long)timer_id > INT_MAX) return NULL; =20 + /* + * The hash lookup and the timers are RCU protected. + * + * Timers are added to the hash in invalid state where + * timr::it_signal =3D=3D NULL. timer::it_signal is only set after the + * rest of the initialization succeeded. + * + * Timer destruction happens in steps: + * 1) Set timr::it_signal to NULL with timr::it_lock held + * 2) Release timr::it_lock + * 3) Remove from the hash under hash_lock + * 4) Call RCU for removal after the grace period + * + * Holding rcu_read_lock() accross the lookup ensures that + * the timer cannot be freed. + * + * The lookup validates locklessly that timr::it_signal =3D=3D + * current::it_signal and timr::it_id =3D=3D @timer_id. timr::it_id + * can't change, but timr::it_signal becomes NULL during + * destruction. + */ rcu_read_lock(); timr =3D posix_timer_by_id(timer_id); if (timr) { spin_lock_irqsave(&timr->it_lock, *flags); + /* + * Validate under timr::it_lock that timr::it_signal is + * still valid. Pairs with #1 above. + */ if (timr->it_signal =3D=3D current->signal) { rcu_read_unlock(); return timr; From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6375BC77B61 for ; Tue, 25 Apr 2023 18:49:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234692AbjDYSt3 (ORCPT ); Tue, 25 Apr 2023 14:49:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44760 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234683AbjDYStL (ORCPT ); Tue, 25 Apr 2023 14:49:11 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D12C916188 for ; Tue, 25 Apr 2023 11:49:06 -0700 (PDT) Message-ID: <20230425183313.143596887@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448545; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=me0I7Ik/2QPR1Cxbi2+BttUOdfbhm4wKXX1mgySouMM=; b=BZ/yP6BsoN6Kaono2yFEiQcD9foanNtBqch0FSIVVI7ewIsR2CtkITKpxKcAdGuAptLhEc bIHcVieXzzVpeJ5rG00ec5AyD8hzKv4rhzLlz0u1TpLucVTEGywLAv501vCuOUD59fi06L UxgpWTbGPyqJC6h2kET0SogqxEQ7WZj56KQ2oeT86f/iTrhXgbPdbKvq+iz8NGJx8dqHLc RH+/kF/vj0KkfA63z2OqdXmlLqVzgmJ43vg8442IMkjMytwWJ18j5IsvNHMGB39pTbwMx5 fNPsiDurCMxLhrXAstojRe/B4ATAXCciNan3Vys/w0GdraUakDCrAaEZEAbzbw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448545; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=me0I7Ik/2QPR1Cxbi2+BttUOdfbhm4wKXX1mgySouMM=; b=GecTvQlK3AjHVOha7Dld2H5pG/RjVzlGyVF9JQnFpRjNq5woiEBG2gQ+6/wkvMxpc6tDQi 0HM/7nptC6ZwZmDg== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 06/20] posix-timers: Annotate concurrent access to k_itimer::it_signal References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:05 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" k_itimer::it_signal is read lockless in the RCU protected hash lookup, but it can be written concurrently in the timer_create() and timer_delete() path. Annotate these places with READ_ONCE() and WRITE_ONCE() Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -109,9 +109,9 @@ static struct k_itimer *__posix_timers_f { struct k_itimer *timer; =20 - hlist_for_each_entry_rcu(timer, head, t_hash, - lockdep_is_held(&hash_lock)) { - if ((timer->it_signal =3D=3D sig) && (timer->it_id =3D=3D id)) + hlist_for_each_entry_rcu(timer, head, t_hash, lockdep_is_held(&hash_lock)= ) { + /* timer->it_signal can be set concurrently */ + if ((READ_ONCE(timer->it_signal) =3D=3D sig) && (timer->it_id =3D=3D id)) return timer; } return NULL; @@ -557,7 +557,7 @@ static int do_timer_create(clockid_t whi =20 spin_lock_irq(¤t->sighand->siglock); /* This makes the timer valid in the hash table */ - new_timer->it_signal =3D current->signal; + WRITE_ONCE(new_timer->it_signal, current->signal); list_add(&new_timer->list, ¤t->signal->posix_timers); spin_unlock_irq(¤t->sighand->siglock); =20 @@ -1051,10 +1051,10 @@ SYSCALL_DEFINE1(timer_delete, timer_t, t list_del(&timer->list); spin_unlock(¤t->sighand->siglock); /* - * This keeps any tasks waiting on the spin lock from thinking - * they got something (see the lock code above). + * A concurrent lookup could check timer::it_signal lockless. It + * will reevaluate with timer::it_lock held and observe the NULL. */ - timer->it_signal =3D NULL; + WRITE_ONCE(timer->it_signal, NULL); =20 unlock_timer(timer, flags); release_posix_timer(timer, IT_ID_SET); From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93AEBC6FD18 for ; Tue, 25 Apr 2023 18:49:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234811AbjDYStc (ORCPT ); Tue, 25 Apr 2023 14:49:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234707AbjDYStM (ORCPT ); Tue, 25 Apr 2023 14:49:12 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6B96117A12 for ; Tue, 25 Apr 2023 11:49:08 -0700 (PDT) Message-ID: <20230425183313.196462644@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448547; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=DCSkADwrTdaHqprFhioGbr3aS4AKwjAJNkVmh+N50Zw=; b=VTZY1lnd2NAe21P++0IRfRXClWQh2YO96ayeMriJurbq5WD0fXi1OND56EjzdwXo+cu0// WRbBXLNioZN/7XNoQgU/61vTEVdgIZBd+fxY9Xd0iH/CUCn9+21keYHwMfz/Q3vFbVYGEk lK6Il3hdAZPbp8Y1ADQrYXY5m2IB2K8iXHQKvijp1nKsyLcU7cl/YULzlsNyU+EPYTUGRQ 1OhDYHCgTGHaO7kQAPWQcjT9CyeRXDH/128ap7dS6yj99+35exBbwlBELtitP5r4igJx7a YMRGP8QgZr2d/HUifuzSk/mhcHGaL4qL5M9akO2yRM844LEP0KQl7BGvEqvcFA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448547; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=DCSkADwrTdaHqprFhioGbr3aS4AKwjAJNkVmh+N50Zw=; b=xtbsT/23TQ81TQI3kADGd7xmm0ZozIe54Bf4xIbRKBneEoMlpD/TGc4UIlh/6a4/e0e5SG 04I9wZdGsJVrkmDA== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 07/20] posix-timers: Set k_itimer::it_signal to NULL on exit() References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:06 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Technically it's not required to set k_itimer::it_signal to NULL on exit() because there is no other thread anymore which could lookup the timer concurrently. Set it to NULL for consistency sake and add a comment to that effect. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -1107,6 +1107,14 @@ static void itimer_delete(struct k_itime } list_del(&timer->list); =20 + /* + * Setting timer::it_signal to NULL is technically not required + * here as nothing can access the timer anymore legitimately via + * the hash table. Set it to NULL nevertheless so that all deletion + * paths are consistent. + */ + WRITE_ONCE(timer->it_signal, NULL); + spin_unlock_irqrestore(&timer->it_lock, flags); release_posix_timer(timer, IT_ID_SET); } From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50857C77B61 for ; Tue, 25 Apr 2023 18:49:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234834AbjDYSte (ORCPT ); Tue, 25 Apr 2023 14:49:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44756 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234665AbjDYStM (ORCPT ); Tue, 25 Apr 2023 14:49:12 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F111B14F43 for ; Tue, 25 Apr 2023 11:49:09 -0700 (PDT) Message-ID: <20230425183313.249063953@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448548; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=Sx10pK8BcTlPxWuC2UdyTLoJxTd/hzNVWxOXwJTCI1U=; b=oVYfclpJ4lXKyc1Bv0jWCtlJnHFR794oSAq6ZcvZ6asVYXISjUvO0tN93BYtwSO12YAd21 MiA5UkB41+BZuAcVdlwhCozJ6bxIb8u0daak4y8sWpeW++b+jPuLhnXj9Xb4IjzSLadoEI eXo3aZ+rMSBfX2vYolhSI2ddy6fTkjTiyl8Zp/rL/IBs4vWg2EgqF7hBomKS3iAc/SekNQ louWpCkTkZ7BFVTcBJAlCAttj+oMMxOd3MCoD+zZdAw/LRmUrQfE2CyJFXtjmsTYLXa2hj gYsPjfalmaSX9INSBITMwbcm9yqSXJMDcpkUprqvvL0cWJ8Y1Z1Kr5yxTDLIeQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448548; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=Sx10pK8BcTlPxWuC2UdyTLoJxTd/hzNVWxOXwJTCI1U=; b=fJxM40v2se4bAIg7K9hcBCTFrE3LoyTK2ertCWxBDpVMTKPMPr3GAupe6nWQ1401iGOGSE 87AUOcaZkmXy4WDQ== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 08/20] posix-timers: Remove pointless irqsafe from hash_lock References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:08 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" All usage of hash_lock is in thread context. No point in using spin_lock_irqsave()/irqrestore() for a single usage site. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -470,10 +470,9 @@ static void k_itimer_rcu_free(struct rcu static void release_posix_timer(struct k_itimer *tmr, int it_id_set) { if (it_id_set) { - unsigned long flags; - spin_lock_irqsave(&hash_lock, flags); + spin_lock(&hash_lock, flags); hlist_del_rcu(&tmr->t_hash); - spin_unlock_irqrestore(&hash_lock, flags); + spin_unlock(&hash_lock, flags); } put_pid(tmr->it_pid); sigqueue_free(tmr->sigq); From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3EBAC77B61 for ; Tue, 25 Apr 2023 18:49:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234846AbjDYSth (ORCPT ); Tue, 25 Apr 2023 14:49:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44760 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234713AbjDYStM (ORCPT ); Tue, 25 Apr 2023 14:49:12 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9138E146CC for ; Tue, 25 Apr 2023 11:49:11 -0700 (PDT) Message-ID: <20230425183313.301432503@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448550; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=vtZji4fDdqL5JPXz+mZaSdd3HdqHgzTa/nenoaE7+wY=; b=MCl8sE1w2k63JlbLaZM3ljMGdbOyP8lh1xDJyAF9pKAUQ5tAH2q8NZVtrGyxEfxpKz3E7Z Ki89MTtfkQiGWSGP9J8/ysV723hlhZj1ofjPVPQ/xyzWTTlCFdJMXqlK5Io8GSy7P2jv5X HjC4PS1LOYB5H+0yqHNji+/C2Er8zFC4ZgzfQ8tDCW1IgCs4PbYOrXnOfLAM1ekpTzLnbD oVeGDLLwxctwm9+Cg50JqI01ILVTWRRlnoSUi1CytwKdt056mRCVweTQhRMf128hlnW+oI K+kENoBynan5rUsnfSdbEGNedUCj3RLI0JzicbOaPaqBuChhFeu9NsonXw+/7w== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448550; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=vtZji4fDdqL5JPXz+mZaSdd3HdqHgzTa/nenoaE7+wY=; b=ZSnJfceYpYgrPMsvVSjfSiZEzahyr073dsjTO3qxPWbU0DqMsMFDGv2Bf9ppE4JRQC3XP6 ondNULoZGLnERuBg== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 09/20] posix-timers: Split release_posix_timers() References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:09 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" release_posix_timers() is called for cleaning up both hashed and unhashed timers. The cases are differentiated by an argument and the usage is hideous. Seperate the actual free path out and use it for unhashed timers. Provide a function for hashed timers. No functional change. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 31 +++++++++++++++---------------- 1 file changed, 15 insertions(+), 16 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -465,20 +465,21 @@ static void k_itimer_rcu_free(struct rcu kmem_cache_free(posix_timers_cache, tmr); } =20 -#define IT_ID_SET 1 -#define IT_ID_NOT_SET 0 -static void release_posix_timer(struct k_itimer *tmr, int it_id_set) -{ - if (it_id_set) { - spin_lock(&hash_lock, flags); - hlist_del_rcu(&tmr->t_hash); - spin_unlock(&hash_lock, flags); - } +static void posix_timer_free(struct k_itimer *tmr) +{ put_pid(tmr->it_pid); sigqueue_free(tmr->sigq); call_rcu(&tmr->rcu, k_itimer_rcu_free); } =20 +static void posix_timer_unhash_and_free(struct k_itimer *tmr) +{ + spin_lock(&hash_lock); + hlist_del_rcu(&tmr->t_hash); + spin_unlock(&hash_lock); + posix_timer_free(tmr); +} + static int common_timer_create(struct k_itimer *new_timer) { hrtimer_init(&new_timer->it.real.timer, new_timer->it_clock, 0); @@ -492,7 +493,6 @@ static int do_timer_create(clockid_t whi const struct k_clock *kc =3D clockid_to_kclock(which_clock); struct k_itimer *new_timer; int error, new_timer_id; - int it_id_set =3D IT_ID_NOT_SET; =20 if (!kc) return -EINVAL; @@ -512,11 +512,10 @@ static int do_timer_create(clockid_t whi */ new_timer_id =3D posix_timer_add(new_timer); if (new_timer_id < 0) { - error =3D new_timer_id; - goto out; + posix_timer_free(new_timer); + return new_timer_id; } =20 - it_id_set =3D IT_ID_SET; new_timer->it_id =3D (timer_t) new_timer_id; new_timer->it_clock =3D which_clock; new_timer->kclock =3D kc; @@ -568,7 +567,7 @@ static int do_timer_create(clockid_t whi * new_timer after the unlock call. */ out: - release_posix_timer(new_timer, it_id_set); + posix_timer_unhash_and_free(new_timer); return error; } =20 @@ -1056,7 +1055,7 @@ SYSCALL_DEFINE1(timer_delete, timer_t, t WRITE_ONCE(timer->it_signal, NULL); =20 unlock_timer(timer, flags); - release_posix_timer(timer, IT_ID_SET); + posix_timer_unhash_and_free(timer); return 0; } =20 @@ -1115,7 +1114,7 @@ static void itimer_delete(struct k_itime WRITE_ONCE(timer->it_signal, NULL); =20 spin_unlock_irqrestore(&timer->it_lock, flags); - release_posix_timer(timer, IT_ID_SET); + posix_timer_unhash_and_free(timer); } =20 /* From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B54A3C6FD18 for ; Tue, 25 Apr 2023 18:49:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234853AbjDYStk (ORCPT ); Tue, 25 Apr 2023 14:49:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44808 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234743AbjDYStT (ORCPT ); Tue, 25 Apr 2023 14:49:19 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7554617A2D for ; Tue, 25 Apr 2023 11:49:13 -0700 (PDT) Message-ID: <20230425183313.356427330@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448551; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=1Xn/v0a0tIvMqOVlnVw+J+mD2M0Fh0VwHZA2QXNtc10=; b=Ipw+A1ZPKhuzFMXkdR00YXoHKH0mbjlYJHCHO4CumRcL4l6uBeP0jd8QWbXW37AcOt8BXV FuQem7OiaOUrAa+YZzcFqlgnrlbidtj3817/Nzr6sVQBwDcTr7iV6V4ZLj7sz9ISh7zJZi ov+05vndaVUANu3Ob1uhsMcTZcW2akqF8ubyjpSsa4C7BFxJM+nSlSMklwVdp2hPEJ7mc4 WFNlFAUCoQmn3noKfIXfzzLJy9CgnzXn/gkRY/vDfXIknUfsDI57mfDRxwv/FENaEDoaI4 xiZA6gOJuZSSrX+rjr97I0n7hjKwTxo8FNXoD1I6hLXYJDHDRmeDISrgJuTS7A== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448551; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=1Xn/v0a0tIvMqOVlnVw+J+mD2M0Fh0VwHZA2QXNtc10=; b=lCXWxrPGHJQfT0LfecpBoJZUukXSftDdkkBGJfaEsSwbkrwR2ODRvkXmZZDLVf9o3PPvZY WYUP3+89N9pAo/Dg== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Michael Kerrisk , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov Subject: [patch 10/20] posix-timers: Document sys_clock_getres() correctly References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:11 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The decades old comment about Posix clock resolution is confusing at best. Remove it and add a proper explanation to sys_clock_getres(). Signed-off-by: Thomas Gleixner Cc: Michael Kerrisk Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 81 ++++++++++++++++++++++++++++++++++++++++= ----- 1 file changed, 73 insertions(+), 8 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -67,14 +67,6 @@ static const struct k_clock clock_realti * to implement others. This structure defines the various * clocks. * - * RESOLUTION: Clock resolution is used to round up timer and interval - * times, NOT to report clock times, which are reported with as - * much resolution as the system can muster. In some cases this - * resolution may depend on the underlying clock hardware and - * may not be quantifiable until run time, and only then is the - * necessary code is written. The standard says we should say - * something about this issue in the documentation... - * * FUNCTIONS: The CLOCKs structure defines possible functions to * handle various clock functions. * @@ -1204,6 +1196,79 @@ SYSCALL_DEFINE2(clock_adjtime, const clo return err; } =20 +/** + * sys_clock_getres - Get the resolution of a clock + * @which_clock: The clock to get the resolution for + * @tp: Pointer to a a user space timespec64 for storage + * + * POSIX defines: + * + * "The clock_getres() function shall return the resolution of any + * clock. Clock resolutions are implementation-defined and cannot be set by + * a process. If the argument res is not NULL, the resolution of the + * specified clock shall be stored in the location pointed to by res. If + * res is NULL, the clock resolution is not returned. If the time argument + * of clock_settime() is not a multiple of res, then the value is truncated + * to a multiple of res." + * + * Due to the various hardware constraints the real resolution can vary + * wildly and even change during runtime when the underlying devices are + * replaced. The kernel also can use hardware devices with different + * resolutions for reading the time and for arming timers. + * + * The kernel therefore deviates from the POSIX spec in various aspects: + * + * 1) The resolution returned to user space + * + * For CLOCK_REALTIME, CLOCK_MONOTONIC, CLOCK_BOOTTIME, CLOCK_TAI, + * CLOCK_REALTIME_ALARM, CLOCK_BOOTTIME_ALAREM and CLOCK_MONOTONIC_RAW + * the kernel differentiates only two cases: + * + * I) Low resolution mode: + * + * When high resolution timers are disabled at compile or runtime + * the resolution returned is nanoseconds per tick, which represents + * the precision at which timers expire. + * + * II) High resolution mode: + * + * When high resolution timers are enabled the resolution returned + * is always one nanosecond independent of the actual resolution of + * the underlying hardware devices. + * + * For CLOCK_*_ALARM the actual resolution depends on system + * state. When system is running the resolution is the same as the + * resolution of the other clocks. During suspend the actual + * resolution is the resolution of the underlying RTC device which + * might be way less precise than the clockevent device used during + * running state. + * + * For CLOCK_REALTIME_COARSE and CLOCK_MONOTONIC_COARSE the resolution + * returned is always nanoseconds per tick. + * + * For CLOCK_PROCESS_CPUTIME and CLOCK_THREAD_CPUTIME the resolution + * returned is always one nanosecond under the assumption that the + * underlying scheduler clock has a better resolution than nanoseconds + * per tick. + * + * For dynamic POSIX clocks (PTP devices) the resolution returned is + * always one nanosecond. + * + * 2) Affect on sys_clock_settime() + * + * The kernel does not truncate the time which is handed in to + * sys_clock_settime(). The kernel internal timekeeping is always using + * nanoseconds precision independent of the clocksource device which is + * used to read the time from. The resolution of that device only + * affects the presicion of the time returned by sys_clock_gettime(). + * + * Returns: + * 0 Success. @tp contains the resolution + * -EINVAL @which_clock is not a valid clock ID + * -EFAULT Copying the resolution to @tp faulted + * -ENODEV Dynamic POSIX clock is not backed by a device + * -EOPNOTSUPP Dynamic POSIX clock does not support getres() + */ SYSCALL_DEFINE2(clock_getres, const clockid_t, which_clock, struct __kernel_timespec __user *, tp) { From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2570EC77B73 for ; Tue, 25 Apr 2023 18:49:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234820AbjDYStw (ORCPT ); Tue, 25 Apr 2023 14:49:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44828 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234766AbjDYStY (ORCPT ); Tue, 25 Apr 2023 14:49:24 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1F91317A04 for ; Tue, 25 Apr 2023 11:49:15 -0700 (PDT) Message-ID: <20230425183313.409169321@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448553; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=OftMSE12zQRmdkVUGBv+nkpk/BkQQU4Y9Jo02sefzOk=; b=nDl5yt7+JD2vDRRpCR3LBaiAJA9pKy8yQqRR2YI/lZZ6K0rueJ6loAqn/WROjzT7j5nDMF sX3YPDurf6WxIBaOlBDAkbTfy604auteDuwbXS/UOeKcJ8e8bPu8JtRItUcc+MWn5vZ04N sW5COWqb1WeHb4jEtT19Yj/2iKufme552mRcsmEAO0YHcnMZnU2aDPTxCytjr+QkrwW1hc 0RwvGqxOiCpN9wGKaygT2bvcipZaoI1wzLJVLztqdNJiUdkGHnZRPCKDiLdDC7x7vDtwRH cySevYKWAWFOnB1p5oGmqSHWyh2pqlbnfxR8ncU4ol1VhYP3eIIyIa5TxNtW7A== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448553; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=OftMSE12zQRmdkVUGBv+nkpk/BkQQU4Y9Jo02sefzOk=; b=Z6Xi5jHpo1B87jSElU/Frrjl9kLNd40sgenJCjf6iEiulTEpFi0fMije2/f5AZLdz3ZOcV a7M1frfjzZ3rEsBw== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 11/20] posix-timers: Document common_clock_get() correctly References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:12 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Replace another confusing and inaccurate set of comments. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 50 +++++++++++++++++++++++++++-------------= ----- 1 file changed, 30 insertions(+), 20 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -659,20 +659,16 @@ static s64 common_hrtimer_forward(struct } =20 /* - * Get the time remaining on a POSIX.1b interval timer. This function - * is ALWAYS called with spin_lock_irq on the timer, thus it must not - * mess with irq. + * Get the time remaining on a POSIX.1b interval timer. * - * We have a couple of messes to clean up here. First there is the case - * of a timer that has a requeue pending. These timers should appear to - * be in the timer list with an expiry as if we were to requeue them - * now. + * Two issues to handle here: * - * The second issue is the SIGEV_NONE timer which may be active but is - * not really ever put in the timer list (to save system resources). - * This timer may be expired, and if so, we will do it here. Otherwise - * it is the same as a requeue pending timer WRT to what we should - * report. + * 1) The timer has a requeue pending. The return value must appear as + * if the timer has been requeued right now. + * + * 2) The timer is a SIGEV_NONE timer. These timers are never enqueued + * into the hrtimer queue and therefore never expired. Emulate expiry + * here taking #1 into account. */ void common_timer_get(struct k_itimer *timr, struct itimerspec64 *cur_sett= ing) { @@ -688,8 +684,12 @@ void common_timer_get(struct k_itimer *t cur_setting->it_interval =3D ktime_to_timespec64(iv); } else if (!timr->it_active) { /* - * SIGEV_NONE oneshot timers are never queued. Check them - * below. + * SIGEV_NONE oneshot timers are never queued and therefore + * timr->it_active is always false. The check below + * vs. remaining time will handle this case. + * + * For all other timers there is nothing to update here, so + * return. */ if (!sig_none) return; @@ -698,18 +698,29 @@ void common_timer_get(struct k_itimer *t now =3D kc->clock_get_ktime(timr->it_clock); =20 /* - * When a requeue is pending or this is a SIGEV_NONE timer move the - * expiry time forward by intervals, so expiry is > now. + * If this is an interval timer and either has requeue pending or + * is a SIGEV_NONE timer move the expiry time forward by intervals, + * so expiry is > now. */ if (iv && (timr->it_requeue_pending & REQUEUE_PENDING || sig_none)) timr->it_overrun +=3D kc->timer_forward(timr, now); =20 remaining =3D kc->timer_remaining(timr, now); - /* Return 0 only, when the timer is expired and not pending */ + /* + * As @now is retrieved before a possible timer_forward() and + * cannot be reevaluated by the compiler @remaining is based on the + * same @now value. Therefore @remaining is consistent vs. @now. + * + * Consequently all interval timers, i.e. @iv > 0, cannot have a + * remaining time <=3D 0 because timer_forward() guarantees to move + * them forward so that the next timer expiry is > @now. + */ if (remaining <=3D 0) { /* - * A single shot SIGEV_NONE timer must return 0, when - * it is expired ! + * A single shot SIGEV_NONE timer must return 0, when it is + * expired! Timers which have a real signal delivery mode + * must return a remaining time greater than 0 because the + * signal has not yet been delivered. */ if (!sig_none) cur_setting->it_value.tv_nsec =3D 1; @@ -718,7 +729,6 @@ void common_timer_get(struct k_itimer *t } } =20 -/* Get the time remaining on a POSIX.1b interval timer. */ static int do_timer_gettime(timer_t timer_id, struct itimerspec64 *settin= g) { struct k_itimer *timr; From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 808BBC6FD18 for ; Tue, 25 Apr 2023 18:49:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234868AbjDYStz (ORCPT ); Tue, 25 Apr 2023 14:49:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45186 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234804AbjDYSt2 (ORCPT ); Tue, 25 Apr 2023 14:49:28 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8AC2717DEB for ; Tue, 25 Apr 2023 11:49:16 -0700 (PDT) Message-ID: <20230425183313.462051641@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448555; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=Zmf4oijJ4qkmpNPO93IBkLhAnn4mWoGj5cJI22MX9Lg=; b=uqHMREOyx+/aWTaOduKAvl9umoYnudFh45Ah+mMG2jN6FF6M2YBU7Fe9k/lHJn0kRrqCjm iB5qiNoegoQAEp8Vaxaj4m6dsiCu1lJEEflHT1kKQ+rUqsWRm8aGq57w6f64CDnNgMkIuC hrCI08xetzruHArKygkP1BJE5/fC7aEVrfotrljAX0g2Hi3yzH7CBB46qIalJAKfYmapHw mA6ta4eMTmuwRNzWbUUjhcN4Znkc3eZCib1/I9Zok+N2qMAhaa9Vgofaxh7xu2mzSl1Z2Z 1pXarTS4Lsz+NCuLF+OKosRyzCQtBavUFIA/bU0RT4L72u28rJj+sJVwu5QCqQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448555; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=Zmf4oijJ4qkmpNPO93IBkLhAnn4mWoGj5cJI22MX9Lg=; b=KG0gt4QfS2XTE0+++hT+G3wWq05Wv2hCSSmhElz37nqd1tnCsNKiXNvir6eLU5cbJkCr2u PJ2UBSKwxyEuCkBg== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Michael Kerrisk , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov Subject: [patch 12/20] posix-timers: Document sys_clock_getoverrun() References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:14 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Document the syscall in detail and with coherent sentences. Signed-off-by: Thomas Gleixner Cc: Michael Kerrisk Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -782,14 +782,23 @@ SYSCALL_DEFINE2(timer_gettime32, timer_t =20 #endif =20 -/* - * Get the number of overruns of a POSIX.1b interval timer. This is to - * be the overrun of the timer last delivered. At the same time we are - * accumulating overruns on the next timer. The overrun is frozen when - * the signal is delivered, either at the notify time (if the info block - * is not queued) or at the actual delivery time (as we are informed by - * the call back to posixtimer_rearm(). So all we need to do is - * to pick up the frozen overrun. +/** + * sys_timer_getoverrun - Get the number of overruns of a POSIX.1b interva= l timer + * @timer_id: The timer ID which identifies the timer + * + * The "overrun count" of a timer is one plus the number of expiration + * intervals which have elapsed between the first expiry, which queues the + * signal and the actual signal delivery. On signal delivery the "overrun + * count" is calculated and cached, so it can be returned directly here. + * + * As this is relative to the last queued signal the returned overrun count + * is meaningless outside of the signal delivery path and even there it + * does not accurately reflect the current state when user space evaluates + * it. + * + * Returns: + * -EINVAL @timer_id is invalid + * 1..INT_MAX The number of overruns related to the last delivered signal */ SYSCALL_DEFINE1(timer_getoverrun, timer_t, timer_id) { From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AA070C77B61 for ; Tue, 25 Apr 2023 18:50:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234875AbjDYSuB (ORCPT ); Tue, 25 Apr 2023 14:50:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45750 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234835AbjDYSte (ORCPT ); Tue, 25 Apr 2023 14:49:34 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 62BBA18E8C for ; Tue, 25 Apr 2023 11:49:18 -0700 (PDT) Message-ID: <20230425183313.514700292@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448556; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=lgf6JYOTW6euMxMOYjqPPRc1RJSaBkir9GoWtN7e358=; b=NjeG5dGI+QXoQmwE0IVWJtdyZ1z2UxBAv2ePE70Sk9iqt0kU0RJCZYS+vfL+ULvVlgDSck p1fAQ5WvkVJVBoh5OdjoVBoz0qzKHxhoStFxbT2toucywWRQA47dq3DFrCHUvgl8szjEft VVaBbFOl2pCOy/kk9DrzAZmhQDlFNgJtPDogDZhyiERmao1ATKhgSdJfklNsRE9ws8Zt2d KQVWeS6WpkrbrUegZWJBrFNRRHPpFnM6fALs6Q0N4sFZ2b05whfBMwhgdhyc15H4s3OQ2w vhZ8pHSmSk9GFhpsP+9WmBX3h1h0btLQbcOU+q5W6kYoK5wOqBWbsNBp3cd6yA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448556; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=lgf6JYOTW6euMxMOYjqPPRc1RJSaBkir9GoWtN7e358=; b=zEkOlMO31FtCg9YakYE1jAgV2nRKOugoFvn2GddGck+moiFgeXzJkcBt67RYqcI3+iDC3G 29o4RZBVzi+/J7Aw== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 13/20] posix-timers: Document sys_clock_settime() permissions in place References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:16 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The documentation of sys_clock_settime() permissions is at a random place and mostly word salad. Remove it and add a concise comment into sys_clock_settime(). Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -74,13 +74,6 @@ static const struct k_clock clock_realti * following: 1.) The k_itimer struct (sched.h) is used for * the timer. 2.) The list, it_lock, it_clock, it_id and * it_pid fields are not modified by timer code. - * - * Permissions: It is assumed that the clock_settime() function defined - * for each clock will take care of permission checks. Some - * clocks may be set able by any user (i.e. local process - * clocks) others not. Currently the only set able clock we - * have is CLOCK_REALTIME and its high res counter part, both of - * which we beg off on and pass to do_sys_settimeofday(). */ static struct k_itimer *__lock_timer(timer_t timer_id, unsigned long *flag= s); =20 @@ -1165,6 +1158,10 @@ SYSCALL_DEFINE2(clock_settime, const clo if (get_timespec64(&new_tp, tp)) return -EFAULT; =20 + /* + * Permission checks have to be done inside the clock specific + * setter callback. + */ return kc->clock_set(which_clock, &new_tp); } From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34C3AC6FD18 for ; Tue, 25 Apr 2023 18:50:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234918AbjDYSuH (ORCPT ); Tue, 25 Apr 2023 14:50:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46088 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234880AbjDYStq (ORCPT ); Tue, 25 Apr 2023 14:49:46 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C45E817A26 for ; Tue, 25 Apr 2023 11:49:19 -0700 (PDT) Message-ID: <20230425183313.567072835@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448558; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=8NduAiJ2J+swWwUoiKJ97uYPpuB6SXNqBekstp0ggR4=; b=uniI75pnAS9TOvDGmGZVsKmTpGEdI0zkV8W39Bh9j4CS6jwK7SePZXC0PFEhjigIof0tKR hfUjXedgBzFvaYT/1oJge5OzjdmM1FTqMM56fPHeH64X2wTtR4RgmynD4DY8WQtey20Za7 toQNRYI0cs7wosSn87CVNDBJaPbWb6J8MP1dtGYqj6nQN0tP8sxJYDNRk5k9UFrf305LUH gX1251nDmA9zYB9WrCDGvA9NIU/NIv/oF5ky1Wm4jh6okYMsgdhmhh0X2ZSvHgESiYIcjS 37NjCmKupda66UurjPkqe8iOlzjq6oaa6zJFjTC+77VXXL3i+IZpnafbWgBxtQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448558; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=8NduAiJ2J+swWwUoiKJ97uYPpuB6SXNqBekstp0ggR4=; b=tHHXQwEvpOzhjSgJCn9tEFVsh2raSSAt1VXbS50b9x8XaRNKQzbrJB5uamjTTG9WIy6dWh Nmr5sCpuU8+bHlCA== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 14/20] posix-timers: Document nanosleep() details References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:17 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The descriptions for common_nsleep() is wrong and common_nsleep_timens() lacks any form of comment. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -1376,7 +1376,7 @@ SYSCALL_DEFINE2(clock_getres_time32, clo #endif =20 /* - * nanosleep for monotonic and realtime clocks + * sys_clock_nanosleep() for CLOCK_REALTIME and CLOCK_TAI */ static int common_nsleep(const clockid_t which_clock, int flags, const struct timespec64 *rqtp) @@ -1388,8 +1388,13 @@ static int common_nsleep(const clockid_t which_clock); } =20 +/* + * sys_clock_nanosleep() for CLOCK_MONOTONIC and CLOCK_BOOTTIME + * + * Absolute nanosleeps for these clocks are time-namespace adjusted. + */ static int common_nsleep_timens(const clockid_t which_clock, int flags, - const struct timespec64 *rqtp) + const struct timespec64 *rqtp) { ktime_t texp =3D timespec64_to_ktime(*rqtp); From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 996BBC6FD18 for ; Tue, 25 Apr 2023 18:50:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234985AbjDYSuP (ORCPT ); Tue, 25 Apr 2023 14:50:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234947AbjDYSts (ORCPT ); Tue, 25 Apr 2023 14:49:48 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6D36F18E99 for ; Tue, 25 Apr 2023 11:49:21 -0700 (PDT) Message-ID: <20230425183313.619897296@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448559; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=72SNJQWXyxgouEM/8YH8e+/nPmMmqp+iUvwo4PZXODk=; b=nlm2jWMZV/r36zj9M8Eg5puJ5X/Xt6zipxQcxaq1MvPaWAbpRAsU/4hOTRMU7mq9Kxg3ym JuF5FcbDqWL8w1QcIUPINEGZy5jc+7nIzNNoioIdn0ifnZ9bmjWvR+VuPhAvsvbyTv9l76 yzLmQ3ApkiiP1lKRhMH+n3qr/rieZLWuchmmwJ6iaDxlOSTZ62Z6eXLbSMXuyEocQFxgkd khP4P2y+Cs9luJKLC76nJCkxPQMymEm3Bzxfr8ZQfUhjgchUU28k1Mjt0NpNsafUuOKjkU nkU4jJQc0MA2gvqy0b1X2oJ4RX6qx/KjvPOxPykNav4LoK4fAq0rd1fU/bMCUA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448559; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=72SNJQWXyxgouEM/8YH8e+/nPmMmqp+iUvwo4PZXODk=; b=GPz3Z/f25iG/vwH5IMEnbmRU54ovrir0UJdTos9D2M6jhxmcR1fCgYvqRhT0PaDaUMY2Nx zERvioRAZs9SSHDw== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 15/20] posix-timers: Add proper comments in do_timer_create() References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:19 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The comment about timer lifetime at the end of the function is misplaced and uncomprehensible. Make it understandable and put it at the right place. Add a new comment about the visibility of the new timer ID to user space. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -528,12 +528,17 @@ static int do_timer_create(clockid_t whi new_timer->sigq->info.si_tid =3D new_timer->it_id; new_timer->sigq->info.si_code =3D SI_TIMER; =20 - if (copy_to_user(created_timer_id, - &new_timer_id, sizeof (new_timer_id))) { + if (copy_to_user(created_timer_id, &new_timer_id, sizeof (new_timer_id)))= { error =3D -EFAULT; goto out; } - + /* + * After succesful copy out, the timer ID is visible to user space + * now but not yet valid because new_timer::signal is still NULL. + * + * Complete the initialization with the clock specific create + * callback. + */ error =3D kc->timer_create(new_timer); if (error) goto out; @@ -543,14 +548,11 @@ static int do_timer_create(clockid_t whi WRITE_ONCE(new_timer->it_signal, current->signal); list_add(&new_timer->list, ¤t->signal->posix_timers); spin_unlock_irq(¤t->sighand->siglock); - - return 0; /* - * In the case of the timer belonging to another task, after - * the task is unlocked, the timer is owned by the other task - * and may cease to exist at any time. Don't use or modify - * new_timer after the unlock call. + * After unlocking sighand::siglock @new_timer is subject to + * concurrent removal and cannot be touched anymore */ + return 0; out: posix_timer_unhash_and_free(new_timer); return error; From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 790DAC77B61 for ; Tue, 25 Apr 2023 18:50:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234503AbjDYSuX (ORCPT ); Tue, 25 Apr 2023 14:50:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46156 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234998AbjDYStu (ORCPT ); Tue, 25 Apr 2023 14:49:50 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F20E918E9F for ; Tue, 25 Apr 2023 11:49:22 -0700 (PDT) Message-ID: <20230425183313.672220780@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448561; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=VWLz1MHVpVYMioS5C8vBOILIM1xk3aX0J2F+OIQgCbk=; b=RkziKtFNP6RD3SMThBazEymOBQa1asoO3FGPWvQXyePX4hPHDwTTG0OsZakCseLfrdOGpf knBG9G61pQpdhUxy6bRYWoc+8ZCapWekwoEibeUZ/+2Fgn+pfc+JrUR6xE8PBJWUr6gklR zLmQadGDWfeDynZ7GpwbfPWl1ey6prcc5tU4uMjNgB2YGjos+sNk46Au/VOBFaxTZL/n6S AkTms53m1A31Q2eVO8Ro+QMukiWq3m6NG9k4P4MPF520JjC69T10wFDfn0rYJklRyLiudz 3T0tXaUU3dkW+PeS9Xk7WmQ4ypMnTM17er6H+866LbmgA3uyNdd16IA/Xjqbaw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448561; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=VWLz1MHVpVYMioS5C8vBOILIM1xk3aX0J2F+OIQgCbk=; b=ICJQ1M4SOgah23Bo8sPdJ6fWjrxsMOpnV7OwmUhaV84xZOmtcdEc8+NPS21qO+QEVcmxpD QNLOjyfNBaB8SICw== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 16/20] posix-timers: Comment SIGEV_THREAD_ID properly References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:20 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Replace the word salad. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -53,12 +53,9 @@ static const struct k_clock * const posi static const struct k_clock *clockid_to_kclock(const clockid_t id); static const struct k_clock clock_realtime, clock_monotonic; =20 -/* - * we assume that the new SIGEV_THREAD_ID shares no bits with the other - * SIGEV values. Here we put out an error if this assumption fails. - */ +/* SIGEV_THREAD_ID cannot share a bit with the other SIGEV values. */ #if SIGEV_THREAD_ID !=3D (SIGEV_THREAD_ID & \ - ~(SIGEV_SIGNAL | SIGEV_NONE | SIGEV_THREAD)) + ~(SIGEV_SIGNAL | SIGEV_NONE | SIGEV_THREAD)) #error "SIGEV_THREAD_ID must not share bit with other SIGEV values!" #endif From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E176AC77B61 for ; Tue, 25 Apr 2023 18:50:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235028AbjDYSuc (ORCPT ); Tue, 25 Apr 2023 14:50:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44814 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234879AbjDYStx (ORCPT ); Tue, 25 Apr 2023 14:49:53 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1BECE17DE4 for ; Tue, 25 Apr 2023 11:49:25 -0700 (PDT) Message-ID: <20230425183313.724863461@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448563; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=zhKy/+ejuXue7alxdJMuNxsTX5eKJNWbTH8CrXSTa84=; b=FzWcsXkY1rn6uaAzMResVDXYjyP3/75Gm3AlbAbLScxnrzNQbyeAyakrbAnFEXjoRxOiKR EQzIN5Dy516lyfpbSO5ze45rXikk7Wjz2CLM9gRRwjh0Di5+FHkq2vntYK+FYfvC445OCB lsKKzZUm5sRrIX3N/S0gnc8OfHc4WZZ0Cw+SkHUG6o2NPrkmIrSwMYqridkN0m95LXFsEm PvvieaC/KzoUhuSbMvngusxe8b6Uw7DfQ5uFS5di7HmLdrshUJ/lOGqJlMzLbfYgJepjSb ZgaKzxxQJq+hzuArqrdDG84kxZPSIR9RZNmdWdQHnwtf28TiFFfChAkof/2EBQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448563; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=zhKy/+ejuXue7alxdJMuNxsTX5eKJNWbTH8CrXSTa84=; b=DmBsE9o+vRUolZwlSEo+qjOxgYPNJwct0Q5CIFDNXIRpYEMpHwuOHxnLLr6wupwhsjrc5m Sgid4XCkrlMWq/CQ== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 17/20] posix-timers: Clarify posix_timer_rearm() comment References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:22 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Yet another incomprehensible piece of art. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -274,15 +274,9 @@ static void common_hrtimer_rearm(struct } =20 /* - * This function is exported for use by the signal deliver code. It is - * called just prior to the info block being released and passes that - * block to us. It's function is to update the overrun entry AND to - * restart the timer. It should only be called if the timer is to be - * restarted (i.e. we have flagged this in the sys_private entry of the - * info block). - * - * To protect against the timer going away while the interrupt is queued, - * we require that the it_requeue_pending flag be set. + * This function is called from the signal delivery code if + * info->si_sys_private is not zero, which indicates that the timer has to + * be rearmed. Restart the timer and update info::si_overrun. */ void posixtimer_rearm(struct kernel_siginfo *info) { From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E3F0C6FD18 for ; Tue, 25 Apr 2023 18:50:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234389AbjDYSup (ORCPT ); Tue, 25 Apr 2023 14:50:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44808 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235011AbjDYSuR (ORCPT ); Tue, 25 Apr 2023 14:50:17 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8981A17A2D for ; Tue, 25 Apr 2023 11:49:36 -0700 (PDT) Message-ID: <20230425183313.777610259@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448564; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=m5Kqsh4JR/w9Cu3b9AUJc4exPQX4NUZsivF0HR7AMXM=; b=nAg/4Ne7AAYygDtnN76h5AZTiIrRn1KYQJcIFl60cNjp7Nn84QDIb1484q8RIgrPnVfXUg N6Ch8MHxSc7DfalJ6QxhZ5meKiAxJj+qaDk2h/4WaGRnMCHDcWFrmnbBqWntU7lEV9uxM4 tP3/mtPlxFeNTeKJ1sd4iJ5QmTt8Dy9IXyx/1XNa3sldpmvKXvCzEAoEJFI/BQy7P/Ew5X Ta73GtL39nmAEp6KJMLYi9G39SUhPVGBN+748tjWi3sP0OK4pEVbJtldPtsZPAg2ttNg+e O2xxliMK+FMdZQhrEhqlnCPE4kLHFkFT5B3ZpgzEv3P78fULEjFMyxEXA7cfuQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448564; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=m5Kqsh4JR/w9Cu3b9AUJc4exPQX4NUZsivF0HR7AMXM=; b=WANxwChzr3gqBMt08n80lCIQi1jCqz/dv9R0coX4NSzLNjRtVZEg2HjqnujVL/DvGGjv9O RgAUfC2+M6KH0WDw== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 18/20] posix-timers: Clarify posix_timer_fn() comments References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:24 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make the issues vs. SIG_IGN understandable and remove the 15 years old promise that a proper solution is already on the horizon. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 56 +++++++++++++++++++++-------------------= ----- 1 file changed, 27 insertions(+), 29 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -325,11 +325,11 @@ int posix_timer_event(struct k_itimer *t } =20 /* - * This function gets called when a POSIX.1b interval timer expires. It - * is used as a callback from the kernel internal timer. The - * run_timer_list code ALWAYS calls with interrupts on. - - * This code is for CLOCK_REALTIME* and CLOCK_MONOTONIC* timers. + * This function gets called when a POSIX.1b interval timer expires from + * the HRTIMER soft interrupt with interrupts enabled. + * + * Handles CLOCK_REALTIME, CLOCK_MONOTONIC, CLOCK_BOOTTIME and CLOCK_TAI + * based timers. */ static enum hrtimer_restart posix_timer_fn(struct hrtimer *timer) { @@ -347,9 +347,10 @@ static enum hrtimer_restart posix_timer_ =20 if (posix_timer_event(timr, si_private)) { /* - * signal was not sent because of sig_ignor - * we will not get a call back to restart it AND - * it should be restarted. + * The signal was not queued due to SIG_IGN. As a + * consequence the timer is not going to be rearmed from + * the signal delivery path. But as a real signal handler + * can be installed later the timer must be rearmed here. */ if (timr->it_interval !=3D 0) { ktime_t now =3D hrtimer_cb_get_time(timer); @@ -358,34 +359,31 @@ static enum hrtimer_restart posix_timer_ * FIXME: What we really want, is to stop this * timer completely and restart it in case the * SIG_IGN is removed. This is a non trivial - * change which involves sighand locking - * (sigh !), which we don't want to do late in - * the release cycle. + * change to the signal handling code. + * + * For now let timers with an interval less than a + * jiffie expire every jiffie to avoid softirq + * starvation in case of SIG_IGN and a very small + * interval, which would put the timer right back + * on the softirq pending list. Moving now ahead of + * time tricks hrtimer_forward() to expire the + * timer later, while it still maintains the + * overrun accuracy for the price of a slightly + * inconsistency in the timer_gettime() case. This + * is at least better than a starved softirq. * - * For now we just let timers with an interval - * less than a jiffie expire every jiffie to - * avoid softirq starvation in case of SIG_IGN - * and a very small interval, which would put - * the timer right back on the softirq pending - * list. By moving now ahead of time we trick - * hrtimer_forward() to expire the timer - * later, while we still maintain the overrun - * accuracy, but have some inconsistency in - * the timer_gettime() case. This is at least - * better than a starved softirq. A more - * complex fix which solves also another related - * inconsistency is already in the pipeline. + * Only required when high resolution timers are + * enabled as the periodic tick based timers are + * automatically aligned to the next tick. */ -#ifdef CONFIG_HIGH_RES_TIMERS - { + if (IS_ENABLED(CONFIG_HIGHRES_TIMERS)) { ktime_t kj =3D NSEC_PER_SEC / HZ; =20 if (timr->it_interval < kj) now =3D ktime_add(now, kj); } -#endif - timr->it_overrun +=3D hrtimer_forward(timer, now, - timr->it_interval); + + timr->it_overrun +=3D hrtimer_forward(timer, now, timr->it_interval); ret =3D HRTIMER_RESTART; ++timr->it_requeue_pending; timr->it_active =3D 1; From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BC34C77B61 for ; Tue, 25 Apr 2023 18:50:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235046AbjDYSu5 (ORCPT ); Tue, 25 Apr 2023 14:50:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45482 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234743AbjDYSub (ORCPT ); Tue, 25 Apr 2023 14:50:31 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 95E4C17A28 for ; Tue, 25 Apr 2023 11:49:47 -0700 (PDT) Message-ID: <20230425183313.832240451@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448566; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=i81xyhGvTy9w945ZtWZh/foaQEfmkM7oK4crwg/Zkto=; b=TiKHpFlnw6PsC7+D5RBxlBFfRCC6LwE6aF2hWgRg7pYPYrCE1Kt3meij4/cHCcogwALmxD VoUhZNiZQP4ZdSoM0RNy5bI58Gqw8i63Yfjyii4g6rr/yu3idvHyFEU0hzmHrtOMlIncTm MuADC8PEwA6DEAQeaP5Yp30IdmxG/XhPz7akqBQpesyvEh7k6XdTa/bikIUsFKpDm0rX69 pOEb4OJVr8gSY/hcWVl2wWsuDjLA2CeeSEJryfxjU7+ZN/JFyNRDXg7c3bgEw2lN14TVh+ 8Kc/G5EQRW85uCLxcBUGCQg0i3LAeLqPRa0zv7tH9jnv7NwY5RSK09dnPAJr3Q== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448566; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=i81xyhGvTy9w945ZtWZh/foaQEfmkM7oK4crwg/Zkto=; b=As1rskEcAO2jOlNgdFnf6Q9Yw+e5WJqqz0ahBhdsPfa+NUY6qqtF1x1SyWar2fEuVY+wiF bkD3Obm2DEBgubBQ== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 19/20] posix-timers: Remove pointless comments References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:25 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Documenting the obvious is just consuming space for no value. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 25 ------------------------- 1 file changed, 25 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -59,19 +59,6 @@ static const struct k_clock clock_realti #error "SIGEV_THREAD_ID must not share bit with other SIGEV values!" #endif =20 -/* - * CLOCKs: The POSIX standard calls for a couple of clocks and allows us - * to implement others. This structure defines the various - * clocks. - * - * FUNCTIONS: The CLOCKs structure defines possible functions to - * handle various clock functions. - * - * The standard POSIX timer management code assumes the - * following: 1.) The k_itimer struct (sched.h) is used for - * the timer. 2.) The list, it_lock, it_clock, it_id and - * it_pid fields are not modified by timer code. - */ static struct k_itimer *__lock_timer(timer_t timer_id, unsigned long *flag= s); =20 #define lock_timer(tid, flags) \ @@ -140,7 +127,6 @@ static inline void unlock_timer(struct k spin_unlock_irqrestore(&timr->it_lock, flags); } =20 -/* Get clock_realtime */ static int posix_get_realtime_timespec(clockid_t which_clock, struct times= pec64 *tp) { ktime_get_real_ts64(tp); @@ -152,7 +138,6 @@ static ktime_t posix_get_realtime_ktime( return ktime_get_real(); } =20 -/* Set clock_realtime */ static int posix_clock_realtime_set(const clockid_t which_clock, const struct timespec64 *tp) { @@ -165,9 +150,6 @@ static int posix_clock_realtime_adj(cons return do_adjtimex(t); } =20 -/* - * Get monotonic time for posix timers - */ static int posix_get_monotonic_timespec(clockid_t which_clock, struct time= spec64 *tp) { ktime_get_ts64(tp); @@ -180,9 +162,6 @@ static ktime_t posix_get_monotonic_ktime return ktime_get(); } =20 -/* - * Get monotonic-raw time for posix timers - */ static int posix_get_monotonic_raw(clockid_t which_clock, struct timespec6= 4 *tp) { ktime_get_raw_ts64(tp); @@ -190,7 +169,6 @@ static int posix_get_monotonic_raw(clock return 0; } =20 - static int posix_get_realtime_coarse(clockid_t which_clock, struct timespe= c64 *tp) { ktime_get_coarse_real_ts64(tp); @@ -241,9 +219,6 @@ static int posix_get_hrtimer_res(clockid return 0; } =20 -/* - * Initialize everything, well, just everything in Posix clocks/timers ;) - */ static __init int init_posix_timers(void) { posix_timers_cache =3D kmem_cache_create("posix_timers_cache", From nobody Thu Feb 12 07:39:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B602BC77B61 for ; Tue, 25 Apr 2023 18:50:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235038AbjDYSuh (ORCPT ); Tue, 25 Apr 2023 14:50:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45556 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231337AbjDYSuM (ORCPT ); Tue, 25 Apr 2023 14:50:12 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E44A218E89 for ; Tue, 25 Apr 2023 11:49:29 -0700 (PDT) Message-ID: <20230425183313.888493625@linutronix.de> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682448567; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=lI8eS5ZquZQ/AMFm1A5eHZZeDCd9KNgXFYHgrZ2R29Q=; b=j2EKBJZ5X7e1Nm5GIqHiop5hf9MbIyUvk9Kdrbd7zpz+e11Vytn077EGh4KEgxK5BwF5MA IRFft7VHcxvu05IszyA855/hOG2Vbm4NkJoc5hLHK35V7nYw25a2cznxLDFLGPEH1s1Atl qdXXGx2JR0OTA5h1MSc8PGnDES7sxYi/5DUKxW+JJLRn2JRAhy3A+x+BPH5oa37Z4ZE2ex pUO2jgJnSnh26UIWaidPZzx487JTIU/DNsqZBrFtkO2Sr5kxfY6gywLIHYliUkreWh4cY8 fzgCKz+O5gG1HVrVWC4eco+I+S/SJFtIhXkkH1OkCkWodQ9Xf5XR3JDnkDpCfg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682448567; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: references:references; bh=lI8eS5ZquZQ/AMFm1A5eHZZeDCd9KNgXFYHgrZ2R29Q=; b=7gRrfeT744csD7sjDoLvP27jRI8wBPWscgtEWH+bQuW3x6z1k+0DfBSnhm0DT3ctK8zMv/ +/OvEIcJ9j1gTcAw== From: Thomas Gleixner To: LKML Cc: Frederic Weisbecker , Anna-Maria Behnsen , Peter Zijlstra , Sebastian Siewior , syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com, Dmitry Vyukov , Michael Kerrisk Subject: [patch 20/20] posix-timers: Polish coding style in a few places References: <20230425181827.219128101@linutronix.de> MIME-Version: 1.0 Date: Tue, 25 Apr 2023 20:49:27 +0200 (CEST) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make it consistent with the TIP tree documentation. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker --- kernel/time/posix-timers.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -308,10 +308,10 @@ int posix_timer_event(struct k_itimer *t */ static enum hrtimer_restart posix_timer_fn(struct hrtimer *timer) { + enum hrtimer_restart ret =3D HRTIMER_NORESTART; struct k_itimer *timr; unsigned long flags; int si_private =3D 0; - enum hrtimer_restart ret =3D HRTIMER_NORESTART; =20 timr =3D container_of(timer, struct k_itimer, it.real.timer); spin_lock_irqsave(&timr->it_lock, flags); @@ -395,8 +395,8 @@ static struct pid *good_sigevent(sigeven =20 static struct k_itimer * alloc_posix_timer(void) { - struct k_itimer *tmr; - tmr =3D kmem_cache_zalloc(posix_timers_cache, GFP_KERNEL); + struct k_itimer *tmr =3D kmem_cache_zalloc(posix_timers_cache, GFP_KERNEL= ); + if (!tmr) return tmr; if (unlikely(!(tmr->sigq =3D sigqueue_alloc()))) { @@ -690,8 +690,8 @@ void common_timer_get(struct k_itimer *t =20 static int do_timer_gettime(timer_t timer_id, struct itimerspec64 *settin= g) { - struct k_itimer *timr; const struct k_clock *kc; + struct k_itimer *timr; unsigned long flags; int ret =3D 0; =20 @@ -762,8 +762,8 @@ SYSCALL_DEFINE2(timer_gettime32, timer_t SYSCALL_DEFINE1(timer_getoverrun, timer_t, timer_id) { struct k_itimer *timr; - int overrun; unsigned long flags; + int overrun; =20 timr =3D lock_timer(timer_id, &flags); if (!timr) @@ -936,8 +936,7 @@ SYSCALL_DEFINE4(timer_settime, timer_t, const struct __kernel_itimerspec __user *, new_setting, struct __kernel_itimerspec __user *, old_setting) { - struct itimerspec64 new_spec, old_spec; - struct itimerspec64 *rtn =3D old_setting ? &old_spec : NULL; + struct itimerspec64 new_spec, old_spec, *rtn; int error =3D 0; =20 if (!new_setting) @@ -946,6 +945,7 @@ SYSCALL_DEFINE4(timer_settime, timer_t, if (get_itimerspec64(&new_spec, new_setting)) return -EFAULT; =20 + rtn =3D old_setting ? &old_spec : NULL; error =3D do_timer_settime(timer_id, flags, &new_spec, rtn); if (!error && old_setting) { if (put_itimerspec64(&old_spec, old_setting))