{"shas":[["5a2bf318945fbecad9267ca779542481bac12508","f2f7d19c5cde48533e43acb214efcc3dbda2125f@google.com","hrtimer: Preserve timer state in remove_hrtimer()\n\nThe race is described as follows:\n\nCPU X                                 CPU Y\nremove_hrtimer\n// state & QUEUED == 0\ntimer->state = CALLBACK\nunlock timer base\ntimer->f(n) //very long\n                                  hrtimer_start\n                                    lock timer base\n                                    remove_hrtimer // no effect\n                                    hrtimer_enqueue\n                                    timer->state = CALLBACK |\n                                                   QUEUED\n                                    unlock timer base\n                                  hrtimer_start\n                                    lock timer base\n                                    remove_hrtimer\n                                        mode = INACTIVE\n                                        // CALLBACK bit lost!\n                                    switch_hrtimer_base\n                                            CALLBACK bit not set:\n                                                    timer->base\n                                                    changes to a\n                                                    different CPU.\nlock this CPU's timer base\n\nThe bug was introduced with commit ca109491f (hrtimer: removing all ur\ncallback modes) in 2.6.29\n\n[ tglx: Feed new state via local variable and add a comment. ]\n\nSigned-off-by: Salman Qazi <sqazi@google.com>\nCc: akpm@linux-foundation.org\nCc: Peter Zijlstra <peterz@infradead.org>\nLKML-Reference: <20101012142351.8485.21823.stgit@dungbeetle.mtv.corp.google.com>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: stable@kernel.org","Salman Qazi"]],"ref":"refs/heads/2.6.29","size":1,"head":"5a2bf318945fbecad9267ca779542481bac12508","push_id":35561109}