Commit da863cdd authored Feb 17, 2012 by Rafael J. Wysocki

PM / Sleep: Fix race conditions related to wakeup source timer function



If __pm_wakeup_event() has been used (with a nonzero timeout) to
report a wakeup event and then __pm_relax() immediately followed by
__pm_stay_awake() is called or __pm_wakeup_event() is called once
again for the same wakeup source object before its timer expires, the
timer function pm_wakeup_timer_fn() may still be run as a result of
the previous __pm_wakeup_event() call.  In either of those cases it
may mistakenly deactivate the wakeup source that has just been
activated.

To prevent that from happening, make wakeup_source_deactivate()
clear the wakeup source's timer_expires field and make
pm_wakeup_timer_fn() check if timer_expires is different from zero
and if it's not in future before calling wakeup_source_deactivate()
(if timer_expires is 0, it means that the timer has just been
deleted and if timer_expires is in future, it means that the timer
has just been rescheduled to a different time).

Reported-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>

parent d94aff87

drivers/base/power/wakeup.c

+14 −2

Original line number	Diff line number	Diff line
		@@ -433,6 +433,7 @@ static void wakeup_source_deactivate(struct wakeup_source *ws)
		ws->max_time = duration;

		del_timer(&ws->timer);
		ws->timer_expires = 0;

		/*
		* Increment the counter of registered wakeup events and decrement the
		@@ -487,11 +488,22 @@ EXPORT_SYMBOL_GPL(pm_relax);
		* pm_wakeup_timer_fn - Delayed finalization of a wakeup event.
		* @data: Address of the wakeup source object associated with the event source.
		*
		* Call __pm_relax() for the wakeup source whose address is stored in @data.
		* Call wakeup_source_deactivate() for the wakeup source whose address is stored
		* in @data if it is currently active and its timer has not been canceled and
		* the expiration time of the timer is not in future.
		*/
		static void pm_wakeup_timer_fn(unsigned long data)
		{
		__pm_relax((struct wakeup_source *)data);
		struct wakeup_source ws = (struct wakeup_source )data;
		unsigned long flags;

		spin_lock_irqsave(&ws->lock, flags);

		if (ws->active && ws->timer_expires
		&& time_after_eq(jiffies, ws->timer_expires))
		wakeup_source_deactivate(ws);

		spin_unlock_irqrestore(&ws->lock, flags);
		}

		/**

Admin message