1 files changed, 50 insertions, 11 deletions

diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index d7f2d91acdac..0ec5b7a1d769 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -442,7 +442,7 @@ static struct k_itimer * alloc_posix_timer(void)
 
 static void k_itimer_rcu_free(struct rcu_head *head)
 {
-        struct k_itimer *tmr = container_of(head, struct k_itimer, it.rcu);
+        struct k_itimer *tmr = container_of(head, struct k_itimer, rcu);
 
         kmem_cache_free(posix_timers_cache, tmr);
 }
@@ -459,7 +459,7 @@ static void release_posix_timer(struct k_itimer *tmr, int it_id_set)
         }
         put_pid(tmr->it_pid);
         sigqueue_free(tmr->sigq);
-        call_rcu(&tmr->it.rcu, k_itimer_rcu_free);
+        call_rcu(&tmr->rcu, k_itimer_rcu_free);
 }
 
 static int common_timer_create(struct k_itimer *new_timer)
@@ -805,6 +805,35 @@ static int common_hrtimer_try_to_cancel(struct k_itimer *timr)
         return hrtimer_try_to_cancel(&timr->it.real.timer);
 }
 
+static void common_timer_wait_running(struct k_itimer *timer)
+{
+        hrtimer_cancel_wait_running(&timer->it.real.timer);
+}
+
+/*
+ * On PREEMPT_RT this prevent priority inversion against softirq kthread in
+ * case it gets preempted while executing a timer callback. See comments in
+ * hrtimer_cancel_wait_running. For PREEMPT_RT=n this just results in a
+ * cpu_relax().
+ */
+static struct k_itimer *timer_wait_running(struct k_itimer *timer,
+                                           unsigned long *flags)
+{
+        const struct k_clock *kc = READ_ONCE(timer->kclock);
+        timer_t timer_id = READ_ONCE(timer->it_id);
+
+        /* Prevent kfree(timer) after dropping the lock */
+        rcu_read_lock();
+        unlock_timer(timer, *flags);
+
+        if (!WARN_ON_ONCE(!kc->timer_wait_running))
+                kc->timer_wait_running(timer);
+
+        rcu_read_unlock();
+        /* Relock the timer. It might be not longer hashed. */
+        return lock_timer(timer_id, flags);
+}
+
 /* Set a POSIX.1b interval timer. */
 int common_timer_set(struct k_itimer *timr, int flags,
                      struct itimerspec64 *new_setting,
@@ -844,13 +873,13 @@ int common_timer_set(struct k_itimer *timr, int flags,
         return 0;
 }
 
-static int do_timer_settime(timer_t timer_id, int flags,
+static int do_timer_settime(timer_t timer_id, int tmr_flags,
                             struct itimerspec64 *new_spec64,
                             struct itimerspec64 *old_spec64)
 {
         const struct k_clock *kc;
         struct k_itimer *timr;
-        unsigned long flag;
+        unsigned long flags;
         int error = 0;
 
         if (!timespec64_valid(&new_spec64->it_interval) ||
@@ -859,8 +888,9 @@ static int do_timer_settime(timer_t timer_id, int flags,
 
         if (old_spec64)
                 memset(old_spec64, 0, sizeof(*old_spec64));
+
+        timr = lock_timer(timer_id, &flags);
 retry:
-        timr = lock_timer(timer_id, &flag);
         if (!timr)
                 return -EINVAL;
 
@@ -868,13 +898,16 @@ retry:
         if (WARN_ON_ONCE(!kc || !kc->timer_set))
                 error = -EINVAL;
         else
-                error = kc->timer_set(timr, flags, new_spec64, old_spec64);
+                error = kc->timer_set(timr, tmr_flags, new_spec64, old_spec64);
 
-        unlock_timer(timr, flag);
         if (error == TIMER_RETRY) {
-                old_spec64 = NULL;      // We already got the old time...
+                // We already got the old time...
+                old_spec64 = NULL;
+                /* Unlocks and relocks the timer if it still exists */
+                timr = timer_wait_running(timr, &flags);
                 goto retry;
         }
+        unlock_timer(timr, flags);
 
         return error;
 }
@@ -951,13 +984,15 @@ SYSCALL_DEFINE1(timer_delete, timer_t, timer_id)
         struct k_itimer *timer;
         unsigned long flags;
 
-retry_delete:
         timer = lock_timer(timer_id, &flags);
+
+retry_delete:
         if (!timer)
                 return -EINVAL;
 
-        if (timer_delete_hook(timer) == TIMER_RETRY) {
-                unlock_timer(timer, flags);
+        if (unlikely(timer_delete_hook(timer) == TIMER_RETRY)) {
+                /* Unlocks and relocks the timer if it still exists */
+                timer = timer_wait_running(timer, &flags);
                 goto retry_delete;
         }
 
@@ -1238,6 +1273,7 @@ static const struct k_clock clock_realtime = {
         .timer_forward          = common_hrtimer_forward,
         .timer_remaining        = common_hrtimer_remaining,
         .timer_try_to_cancel    = common_hrtimer_try_to_cancel,
+        .timer_wait_running     = common_timer_wait_running,
         .timer_arm              = common_hrtimer_arm,
 };
 
@@ -1253,6 +1289,7 @@ static const struct k_clock clock_monotonic = {
         .timer_forward          = common_hrtimer_forward,
         .timer_remaining        = common_hrtimer_remaining,
         .timer_try_to_cancel    = common_hrtimer_try_to_cancel,
+        .timer_wait_running     = common_timer_wait_running,
         .timer_arm              = common_hrtimer_arm,
 };
 
@@ -1283,6 +1320,7 @@ static const struct k_clock clock_tai = {
         .timer_forward          = common_hrtimer_forward,
         .timer_remaining        = common_hrtimer_remaining,
         .timer_try_to_cancel    = common_hrtimer_try_to_cancel,
+        .timer_wait_running     = common_timer_wait_running,
         .timer_arm              = common_hrtimer_arm,
 };
 
@@ -1298,6 +1336,7 @@ static const struct k_clock clock_boottime = {
         .timer_forward          = common_hrtimer_forward,
         .timer_remaining        = common_hrtimer_remaining,
         .timer_try_to_cancel    = common_hrtimer_try_to_cancel,
+        .timer_wait_running     = common_timer_wait_running,
         .timer_arm              = common_hrtimer_arm,
 };