lkml.org 
[lkml]   [2023]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectWARNING in do_timer_settime
Hi,

I'm looking an issue detected during fuzzing "WARNING in
do_timer_settime". Its report is attached at the end of this email.

I think this does not cause any serious issue, but my rough sketch of
a scenario causing the warning is a race condition caused by two
timer_settime() system calls for CLOCK_PROCESS_CPUTIME_ID.

CPU1 CPU2
----- -----
do_timer_settime(CLOCK_PROCESS_CPUTIME_ID)
posix_cpu_timer_set()
arm_timer(timer, p);

timer interrupt handler
run_posix_cpu_timers()
handle_posix_cpu_timers()
lock_task_sighand()
check_process_timers()
collect_posix_cpu_timers() do_timer_settime(CLOCK_PROCESS_CPUTIME_ID)
ctmr->firing = 1; - (1) posix_cpu_timer_set()
unlock_task_sighand() - (2)
lock_task_sighand() // can acquire the sighand
// lock because of (2)
if (timer->it.cpu.firing)) // true because of (1) and (3)
ret = TIMER_RETRY;
..
return tret;
timer_wait_running()
WARN_ON(!kc->timer_was_running);
// kc->timer_was_running is NULL in clock_posix_cpu
timer->it.cpu.firing = 0; - (3)


But regardless of the scenario, I wonder if the commit ec8f954a40d
("posix-timers: Use a callback for cancel synchronization on
PREEMPT_RT") missed initializations to the timer_was_running field in
clock_posix_cpu. I can see that the commit initialized the
timer_was_running field of all other clocks but clock_posix_cpu. So I
think the warning does not occur if the timer_was_running field of
clock_posix_cpu is initialized to, for example,
common_timer_wait_running. Could you please check this?

Thank you in advance.


Best regards,
Dae R. Jeong

-----
- Kernel version:
6.2.0-rc7

- Report:
WARNING: CPU: 1 PID: 13389 at kernel/time/posix-timers.c:849 do_timer_settime+0x193/0x200 kernel/time/posix-timers.c:929
Modules linked in:
CPU: 1 PID: 13389 Comm: syz-executor.0 Not tainted 6.2.0-rc7-32171-g7f09e8f6ebfb #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
<- omitting registers ->
Call Trace:
<TASK>
__do_sys_timer_settime kernel/time/posix-timers.c:952 [inline]
__se_sys_timer_settime kernel/time/posix-timers.c:938 [inline]
__x64_sys_timer_settime+0xa3/0x110 kernel/time/posix-timers.c:938
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x478d29
<- omitting registers ->
</TASK>
---[ end trace 0000000000000000 ]---

\
 
 \ /
  Last update: 2023-03-27 09:19    [W:0.051 / U:0.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site