mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 07:51:31 -04:00
Code Issues Packages Projects Releases Wiki Activity

alarmtimer: Access timerqueue node under lock in suspend

Browse Source 
In alarmtimer_suspend(), timerqueue_getnext() is called under
base->lock, but next->expires is read after the lock is released.

This is safe because suspend freezes all relevant task contexts,
but reading the node while holding the lock makes the code easier
to reason about and not worry about a theoretical UAF.

Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260407143627.19405-1-zhanxusheng@xiaomi.com
This commit is contained in:
Zhan Xusheng
2026-04-07 22:36:27 +08:00
committed by Thomas Gleixner
parent c5283a1ffd
commit 09c04714cb
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
kernel/time/alarmtimer.c
View File

@@ -234,19 +234,23 @@ static int alarmtimer_suspend(struct device *dev)
if (!rtc)
return 0;
/* Find the soonest timer to expire*/
/* Find the soonest timer to expire */
for (i = 0; i < ALARM_NUMTYPE; i++) {
struct alarm_base *base = &alarm_bases[i];
struct timerqueue_node *next;
ktime_t next_expires;
ktime_t delta;
scoped_guard(spinlock_irqsave, &base->lock)
scoped_guard(spinlock_irqsave, &base->lock) {
next = timerqueue_getnext(&base->timerqueue);
if (next)
next_expires = next->expires;
}
if (!next)
continue;
delta = ktime_sub(next->expires, base->get_ktime());
delta = ktime_sub(next_expires, base->get_ktime());
if (!min || (delta < min)) {
expires = next->expires;
expires = next_expires;
min = delta;
type = i;
}