Commit 2389c6ef authored by Thomas Gleixner's avatar Thomas Gleixner
Browse files

posix-timers: Ensure that timer initialization is fully visible



Frederic pointed out that the memory operations to initialize the timer are
not guaranteed to be visible, when __lock_timer() observes timer::it_signal
valid under timer::it_lock:

  T0                                      T1
  ---------                               -----------
  do_timer_create()
      // A
      new_timer->.... = ....
      spin_lock(current->sighand)
      // B
      WRITE_ONCE(new_timer->it_signal, current->signal)
      spin_unlock(current->sighand)
					sys_timer_*()
					   t =  __lock_timer()
						  spin_lock(&timr->it_lock)
						  // observes B
						  if (timr->it_signal == current->signal)
						    return timr;
			                   if (!t)
					       return;
					// Is not guaranteed to observe A

Protect the write of timer::it_signal, which makes the timer valid, with
timer::it_lock as well. This guarantees that T1 must observe the
initialization A completely, when it observes the valid signal pointer
under timer::it_lock. sighand::siglock must still be taken to protect the
signal::posix_timers list.

Reported-by: default avatarFrederic Weisbecker <frederic@kernel.org>
Suggested-by: default avatarFrederic Weisbecker <frederic@kernel.org>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Reviewed-by: default avatarFrederic Weisbecker <frederic@kernel.org>
Link: https://lore.kernel.org/all/20250308155623.507944489@linutronix.de
parent fc661d0a
Loading
Loading
Loading
Loading
+14 −7
Original line number Diff line number Diff line
@@ -462,14 +462,21 @@ static int do_timer_create(clockid_t which_clock, struct sigevent *event,
	if (error)
		goto out;

	spin_lock_irq(&current->sighand->siglock);
	/*
	 * timer::it_lock ensures that __lock_timer() observes a fully
	 * initialized timer when it observes a valid timer::it_signal.
	 *
	 * sighand::siglock is required to protect signal::posix_timers.
	 */
	scoped_guard (spinlock_irq, &new_timer->it_lock) {
		guard(spinlock)(&current->sighand->siglock);
		/* This makes the timer valid in the hash table */
		WRITE_ONCE(new_timer->it_signal, current->signal);
		hlist_add_head(&new_timer->list, &current->signal->posix_timers);
	spin_unlock_irq(&current->sighand->siglock);
	}
	/*
	 * After unlocking sighand::siglock @new_timer is subject to
	 * concurrent removal and cannot be touched anymore
	 * After unlocking @new_timer is subject to concurrent removal and
	 * cannot be touched anymore
	 */
	return 0;
out: