| Message ID | 20190821092409.13225-4-julien.grall@arm.com |
|---|---|
| State | New |
| Headers | show |
| Series | None | expand |
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c index 119414a2f59c..5eb45a868de9 100644 --- a/kernel/time/hrtimer.c +++ b/kernel/time/hrtimer.c @@ -934,7 +934,7 @@ void hrtimer_grab_expiry_lock(const struct hrtimer *timer) { struct hrtimer_clock_base *base = READ_ONCE(timer->base); - if (timer->is_soft && base && base->cpu_base) { + if (timer->is_soft && base != &migration_base) { spin_lock(&base->cpu_base->softirq_expiry_lock); spin_unlock(&base->cpu_base->softirq_expiry_lock); }
migration_base is used as a placeholder when an hrtimer is switching between base (see switch_hrtimer_timer_base). It is possible theoritically possible to have timer->base equal to migration_base. Even if it is a placeholder, it would pass all the current check in hrtimer_grab_expiry_lock() leading to use softirq_expiry_lock uninitialized. This is can be prevented by checking whether the base is equal to the placeholder (i.e. migration_base). Furthermore, all the path leading to hrtimer_grab_expiry_lock() assumes timer->base and timer->base->cpu_base are always non-NULL. So it is safe to remove the NULL checks here. Signed-off-by: Julien Grall <julien.grall@arm.com> --- I don't have a reproducer so far, but I can't see why it would not be possible to happen. --- kernel/time/hrtimer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.11.0