Commit 3ed769bd authored Sep 18, 2015 by Dmitry Vyukov Committed by Thomas Gleixner Sep 22, 2015

timers: Fix data race in timer_stats_account_timer()



timer_stats_account_timer() reads timer->start_site, then checks it
for NULL and then re-reads it again, while
timer_stats_timer_clear_start_info() can concurrently reset
timer->start_site to NULL. This should not lead to crashes, but can
double number of entries in timer stats as start_site is used during
comparison, the doubled entries will have unuseful NULL start_site.

Read timer->start_site only once in timer_stats_account_timer().

The data race was found with KernelThreadSanitizer (KTSAN).

Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Cc: andreyknvl@google.com
Cc: glider@google.com
Cc: kcc@google.com
Cc: ktsan@googlegroups.com
Cc: john.stultz@linaro.org
Link: http://lkml.kernel.org/r/1442584463-69553-1-git-send-email-dvyukov@google.com


Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

parent 571af55a

kernel/time/timer.c

+9 −2

Original line number	Diff line number	Diff line
		@@ -461,10 +461,17 @@ void __timer_stats_timer_set_start_info(struct timer_list timer, void addr)

		static void timer_stats_account_timer(struct timer_list *timer)
		{
		if (likely(!timer->start_site))
		void *site;

		/*
		* start_site can be concurrently reset by
		* timer_stats_timer_clear_start_info()
		*/
		site = READ_ONCE(timer->start_site);
		if (likely(!site))
		return;

		timer_stats_update_stats(timer, timer->start_pid, timer->start_site,
		timer_stats_update_stats(timer, timer->start_pid, site,
		timer->function, timer->start_comm,
		timer->flags);
		}

Admin message