timers: Use timer_shutdown*() before freeing timers

Back in April, I posted an RFC patch set to help mitigate a common issue where a timer gets armed just before it is freed, and when the timer goes off, it crashes in the timer code without any evidence of who the culprit was. I got side tracked and never finished up on that patch set. Since this type of crash is still our #1 crash we are seeing in the field, it has become a priority again to finish it.

This is v3 of that patch set. Thomas Gleixner posted an untested version that makes timer->function NULL as the flag that it is shutdown. I took that code, tested it (fixed it up), added more comments, and changed the name to timer_shutdown_sync(). I also converted it to use WARN_ON_ONCE() instead of just WARN_ON() as Linus asked for.

I then created a trivial coccinelle script to find where del_timer*() is called before being freed, and converted them all to timer_shutdown*() (There was a couple that still used del_timer() instead of del_timer_sync()).

I also updated DEBUG_OBJECTS_TIMERS to check from where the timer is ever armed, to calling of timer_shutdown_sync(), and it will trigger if a timer is freed in between. The current way is to only check if the timer is armed, but that means it only triggers if the race condition is hit, and with experience, it's not run on enough machines to catch all of them. By triggering it from the time the timer is armed to the time it is shutdown, it catches all potential cases even if the race condition is not hit.

I went though the result of the cocinelle script, and updated the locations. Some locations were caught by DEBUG_OBJECTS_TIMERS as the coccinelle script only checked for timers being freed in the same function as the del_timer*().

Ideally, I would have the first patch go into this rc cycle, which is mostly non functional as it will allow the other patches to come in via the respective subsystems in the next merge window.

Changes since v2: https://lore.kernel.org/all/[email protected]/

- Talking with Thomas Gleixner, he wanted a better name space and to remove the "del_" portion of the API.

- Since there's now a shutdown interface that does not synchronize, to keep it closer to del_timer() and del_timer_sync(), the API is now:

timer_shutdown() - same as del_timer() but deactivates the timer.

timer_shutdown_sync() - same as del_timer_sync() but deactivates the timer.

- Added a few more locations that got converted.

git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
trace/timers

Head SHA1: 25106f0bb7968b3e8c746a7853f44b51840746c3

Steven Rostedt (Google) (33):
timers: Add timer_shutdown_sync() and timer_shutdown() to be called before freeing timers
timers: s390/cmm: Use timer_shutdown_sync() before freeing timer
timers: sh: Use timer_shutdown_sync() before freeing timer
timers: block: Use timer_shutdown_sync() before freeing timer
timers: ACPI: Use timer_shutdown_sync() before freeing timer
timers: atm: Use timer_shutdown_sync() before freeing timer
timers: PM: Use timer_shutdown_sync()
timers: Bluetooth: Use timer_shutdown_sync() before freeing timer
timers: hangcheck: Use timer_shutdown_sync() before freeing timer
timers: ipmi: Use timer_shutdown_sync() before freeing timer
random: use timer_shutdown_sync() before freeing timer
timers: dma-buf: Use timer_shutdown_sync() before freeing timer
timers: drm: Use timer_shutdown_sync() before freeing timer
timers: HID: Use timer_shutdown_sync() before freeing timer
timers: Input: Use timer_shutdown_sync() before freeing timer
timers: mISDN: Use timer_shutdown_sync() before freeing timer
timers: leds: Use timer_shutdown_sync() before freeing timer
timers: media: Use timer_shutdown_sync() before freeing timer
timers: net: Use timer_shutdown_sync() before freeing timer
timers: usb: Use timer_shutdown_sync() before freeing timer
timers: cgroup: Use timer_shutdown_sync() before freeing timer
timers: workqueue: Use timer_shutdown_sync() before freeing timer
timers: nfc: pn533: Use timer_shutdown_sync() before freeing timer
timers: pcmcia: Use timer_shutdown_sync() before freeing timer
timers: scsi: Use timer_shutdown_sync() and timer_shutdown() before freeing timer
timers: tty: Use timer_shutdown_sync() before freeing timer
timers: ext4: Use timer_shutdown_sync() before freeing timer
timers: fs/nilfs2: Use timer_shutdown_sync() before freeing timer
timers: ALSA: Use timer_shutdown_sync() before freeing timer
timers: jbd2: Use timer_shutdown() before freeing timer
timers: sched/psi: Use timer_shutdown_sync() before freeing timer
timers: x86/mce: Use __init_timer() for resetting timers
timers: Expand DEBUG_OBJECTS_TIMER to check if it ever was used

----

 .../RCU/Design/Requirements/Requirements.rst       |   2 +-
 Documentation/core-api/local_ops.rst               |   2 +-
 Documentation/kernel-hacking/locking.rst           |   5 +
 arch/s390/mm/cmm.c                                 |   4 +-
 arch/sh/drivers/push-switch.c                      |   2 +-
 arch/x86/kernel/cpu/mce/core.c                     |  14 ++-
 block/blk-iocost.c                                 |   2 +-
 block/blk-iolatency.c                              |   2 +-
 block/blk-stat.c                                   |   2 +-
 block/blk-throttle.c                               |   2 +-
 block/kyber-iosched.c                              |   2 +-
 drivers/acpi/apei/ghes.c                           |   2 +-
 drivers/atm/idt77105.c                             |   4 +-
 drivers/atm/idt77252.c                             |   4 +-
 drivers/atm/iphase.c                               |   2 +-
 drivers/base/power/wakeup.c                        |   7 +-
 drivers/block/drbd/drbd_main.c                     |   2 +-
 drivers/block/loop.c                               |   2 +-
 drivers/block/sunvdc.c                             |   2 +-
 drivers/bluetooth/hci_bcsp.c                       |   2 +-
 drivers/bluetooth/hci_h5.c                         |   2 +-
 drivers/bluetooth/hci_qca.c                        |   4 +-
 drivers/char/hangcheck-timer.c                     |   4 +-
 drivers/char/ipmi/ipmi_msghandler.c                |   2 +-
 drivers/char/ipmi/ipmi_ssif.c                      |   4 +-
 drivers/char/random.c                              |   2 +-
 drivers/dma-buf/st-dma-fence.c                     |   2 +-
 drivers/gpu/drm/gud/gud_pipe.c                     |   2 +-
 drivers/gpu/drm/i915/i915_sw_fence.c               |   2 +-
 drivers/hid/hid-wiimote-core.c                     |   2 +-
 drivers/input/keyboard/locomokbd.c                 |   2 +-
 drivers/input/keyboard/omap-keypad.c               |   2 +-
 drivers/input/mouse/alps.c                         |   2 +-
 drivers/input/serio/hil_mlc.c                      |   2 +-
 drivers/input/serio/hp_sdc.c                       |   2 +-
 drivers/isdn/hardware/mISDN/hfcmulti.c             |   6 +-
 drivers/isdn/mISDN/l1oip_core.c                    |   4 +-
 drivers/isdn/mISDN/timerdev.c                      |   4 +-
 drivers/leds/trigger/ledtrig-activity.c            |   2 +-
 drivers/leds/trigger/ledtrig-heartbeat.c           |   2 +-
 drivers/leds/trigger/ledtrig-pattern.c             |   2 +-
 drivers/leds/trigger/ledtrig-transient.c           |   2 +-
 drivers/media/pci/ivtv/ivtv-driver.c               |   2 +-
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c            |  18 ++--
 drivers/media/usb/s2255/s2255drv.c                 |   4 +-
 drivers/net/ethernet/intel/i40e/i40e_main.c        |   6 +-
 drivers/net/ethernet/marvell/sky2.c                |   2 +-
 drivers/net/ethernet/sun/sunvnet.c                 |   2 +-
 drivers/net/usb/sierra_net.c                       |   2 +-
 drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c   |   2 +-
 drivers/net/wireless/intersil/hostap/hostap_ap.c   |   2 +-
 drivers/net/wireless/marvell/mwifiex/main.c        |   2 +-
 drivers/net/wireless/microchip/wilc1000/hif.c      |   8 +-
 drivers/nfc/pn533/pn533.c                          |   2 +-
 drivers/nfc/pn533/uart.c                           |   2 +-
 drivers/pcmcia/bcm63xx_pcmcia.c                    |   2 +-
 drivers/pcmcia/electra_cf.c                        |   2 +-
 drivers/pcmcia/omap_cf.c                           |   2 +-
 drivers/pcmcia/pd6729.c                            |   4 +-
 drivers/pcmcia/yenta_socket.c                      |   4 +-
 drivers/scsi/qla2xxx/qla_edif.c                    |   4 +-
 drivers/scsi/scsi_lib.c                            |   1 +
 drivers/staging/media/atomisp/i2c/atomisp-lm3554.c |   2 +-
 drivers/tty/n_gsm.c                                |   2 +-
 drivers/tty/sysrq.c                                |   2 +-
 drivers/usb/gadget/udc/m66592-udc.c                |   2 +-
 drivers/usb/serial/garmin_gps.c                    |   2 +-
 drivers/usb/serial/mos7840.c                       |   2 +-
 fs/ext4/super.c                                    |   2 +-
 fs/jbd2/journal.c                                  |   2 +
 fs/nilfs2/segment.c                                |   2 +-
 include/linux/timer.h                              | 100 +++++++++++++++++--
 include/linux/workqueue.h                          |   4 +-
 kernel/cgroup/cgroup.c                             |   2 +-
 kernel/sched/psi.c                                 |   1 +
 kernel/time/timer.c                                | 106 ++++++++++++++-------
 kernel/workqueue.c                                 |   4 +-
 net/802/garp.c                                     |   2 +-
 net/802/mrp.c                                      |   2 +-
 net/bridge/br_multicast.c                          |   6 +-
 net/bridge/br_multicast_eht.c                      |   4 +-
 net/core/gen_estimator.c                           |   2 +-
 net/core/neighbour.c                               |   2 +
 net/ipv4/inet_connection_sock.c                    |   2 +-
 net/ipv4/inet_timewait_sock.c                      |   3 +-
 net/ipv4/ipmr.c                                    |   2 +-
 net/ipv6/ip6mr.c                                   |   2 +-
 net/mac80211/mesh_pathtbl.c                        |   2 +-
 net/netfilter/ipset/ip_set_list_set.c              |   2 +-
 net/netfilter/ipvs/ip_vs_lblc.c                    |   2 +-
 net/netfilter/ipvs/ip_vs_lblcr.c                   |   2 +-
 net/netfilter/xt_LED.c                             |   2 +-
 net/rxrpc/conn_object.c                            |   2 +-
 net/sched/cls_flow.c                               |   2 +-
 net/sunrpc/svc.c                                   |   2 +-
 net/sunrpc/xprt.c                                  |   2 +-
 net/tipc/discover.c                                |   2 +-
 net/tipc/monitor.c                                 |   2 +-
 sound/i2c/other/ak4117.c                           |   2 +-
 sound/synth/emux/emux.c                            |   2 +-
 100 files changed, 310 insertions(+), 175 deletions(-)

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 block/blk-iocost.c             | 2 +-
 block/blk-iolatency.c          | 2 +-
 block/blk-stat.c               | 2 +-
 block/blk-throttle.c           | 2 +-
 block/kyber-iosched.c          | 2 +-
 drivers/block/drbd/drbd_main.c | 2 +-
 drivers/block/loop.c           | 2 +-
 drivers/block/sunvdc.c         | 2 +-
 8 files changed, 8 insertions(+), 8 deletions(-)

index 495396425bad..7edc695b3a3d 100644
@@ -2814,7 +2814,7 @@ static void ioc_rqos_exit(struct rq_qos *rqos)
 	ioc->running = IOC_STOP;
 	spin_unlock_irq(&ioc->lock);
 
-	del_timer_sync(&ioc->timer);
+	timer_shutdown_sync(&ioc->timer);
 	free_percpu(ioc->pcpu_stat);
 	kfree(ioc);
 }

index 571fa95aafe9..c7049ab18312 100644
@@ -645,7 +645,7 @@ static void blkcg_iolatency_exit(struct rq_qos *rqos)
 {
 	struct blk_iolatency *blkiolat = BLKIOLATENCY(rqos);
 
-	del_timer_sync(&blkiolat->timer);
+	timer_shutdown_sync(&blkiolat->timer);
 	flush_work(&blkiolat->enable_work);
 	blkcg_deactivate_policy(rqos->q, &blkcg_policy_iolatency);
 	kfree(blkiolat);

index 2ea01b5c1aca..855da21de5dc 100644
@@ -165,7 +165,7 @@ void blk_stat_remove_callback(struct request_queue *q,
 		blk_queue_flag_clear(QUEUE_FLAG_STATS, q);
 	spin_unlock_irqrestore(&q->stats->lock, flags);
 
-	del_timer_sync(&cb->timer);
+	timer_shutdown_sync(&cb->timer);
 }
 
 static void blk_stat_free_callback_rcu(struct rcu_head *head)

index 847721dc2b2b..38740c4f517a 100644
@@ -490,7 +490,7 @@ static void throtl_pd_free(struct blkg_policy_data *pd)
 {
 	struct throtl_grp *tg = pd_to_tg(pd);
 
-	del_timer_sync(&tg->service_queue.pending_timer);
+	timer_shutdown_sync(&tg->service_queue.pending_timer);
 	blkg_rwstat_exit(&tg->stat_bytes);
 	blkg_rwstat_exit(&tg->stat_ios);
 	kfree(tg);

index b05357bced99..2146969237bf 100644
@@ -434,7 +434,7 @@ static void kyber_exit_sched(struct elevator_queue *e)
 	struct kyber_queue_data *kqd = e->elevator_data;
 	int i;
 
-	del_timer_sync(&kqd->timer);
+	timer_shutdown_sync(&kqd->timer);
 	blk_stat_disable_accounting(kqd->q);
 
 	for (i = 0; i < KYBER_NUM_DOMAINS; i++)

index f3e4db16fd07..2dc5be89a001 100644
@@ -2184,7 +2184,7 @@ void drbd_destroy_device(struct kref *kref)
 	struct drbd_resource *resource = device->resource;
 	struct drbd_peer_device *peer_device, *tmp_peer_device;
 
-	del_timer_sync(&device->request_timer);
+	timer_shutdown_sync(&device->request_timer);
 
 	/* paranoia asserts */
 	D_ASSERT(device, device->open_cnt == 0);

index ad92192c7d61..3ea087cd1f99 100644
@@ -1755,7 +1755,7 @@ static void lo_free_disk(struct gendisk *disk)
 	if (lo->workqueue)
 		destroy_workqueue(lo->workqueue);
 	loop_free_idle_workers(lo, true);
-	del_timer_sync(&lo->timer);
+	timer_shutdown_sync(&lo->timer);
 	mutex_destroy(&lo->lo_mutex);
 	kfree(lo);
 }

index fb855da971ee..e14fe5d968d8 100644
@@ -1067,7 +1067,7 @@ static void vdc_port_remove(struct vio_dev *vdev)
 
 		flush_work(&port->ldc_reset_work);
 		cancel_delayed_work_sync(&port->ldc_reset_timer_work);
-		del_timer_sync(&port->vio.timer);
+		timer_shutdown_sync(&port->vio.timer);
 
 		del_gendisk(port->disk);
 		put_disk(port->disk);

2.35.1
_______________________________________________
drbd-dev mailing list
[email protected]
https://lists.linbit.com/mailman/listinfo/drbd-dev

[ Once again, quilt fails the MIME coding ]

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 block/blk-iocost.c             | 2 +-
 block/blk-iolatency.c          | 2 +-
 block/blk-stat.c               | 2 +-
 block/blk-throttle.c           | 2 +-
 block/kyber-iosched.c          | 2 +-
 drivers/block/drbd/drbd_main.c | 2 +-
 drivers/block/loop.c           | 2 +-
 drivers/block/sunvdc.c         | 2 +-
 8 files changed, 8 insertions(+), 8 deletions(-)

index 495396425bad..7edc695b3a3d 100644
@@ -2814,7 +2814,7 @@ static void ioc_rqos_exit(struct rq_qos *rqos)
 	ioc->running = IOC_STOP;
 	spin_unlock_irq(&ioc->lock);
 
-	del_timer_sync(&ioc->timer);
+	timer_shutdown_sync(&ioc->timer);
 	free_percpu(ioc->pcpu_stat);
 	kfree(ioc);
 }

index 571fa95aafe9..c7049ab18312 100644
@@ -645,7 +645,7 @@ static void blkcg_iolatency_exit(struct rq_qos *rqos)
 {
 	struct blk_iolatency *blkiolat = BLKIOLATENCY(rqos);
 
-	del_timer_sync(&blkiolat->timer);
+	timer_shutdown_sync(&blkiolat->timer);
 	flush_work(&blkiolat->enable_work);
 	blkcg_deactivate_policy(rqos->q, &blkcg_policy_iolatency);
 	kfree(blkiolat);

index 2ea01b5c1aca..855da21de5dc 100644
@@ -165,7 +165,7 @@ void blk_stat_remove_callback(struct request_queue *q,
 		blk_queue_flag_clear(QUEUE_FLAG_STATS, q);
 	spin_unlock_irqrestore(&q->stats->lock, flags);
 
-	del_timer_sync(&cb->timer);
+	timer_shutdown_sync(&cb->timer);
 }
 
 static void blk_stat_free_callback_rcu(struct rcu_head *head)

index 847721dc2b2b..38740c4f517a 100644
@@ -490,7 +490,7 @@ static void throtl_pd_free(struct blkg_policy_data *pd)
 {
 	struct throtl_grp *tg = pd_to_tg(pd);
 
-	del_timer_sync(&tg->service_queue.pending_timer);
+	timer_shutdown_sync(&tg->service_queue.pending_timer);
 	blkg_rwstat_exit(&tg->stat_bytes);
 	blkg_rwstat_exit(&tg->stat_ios);
 	kfree(tg);

index b05357bced99..2146969237bf 100644
@@ -434,7 +434,7 @@ static void kyber_exit_sched(struct elevator_queue *e)
 	struct kyber_queue_data *kqd = e->elevator_data;
 	int i;
 
-	del_timer_sync(&kqd->timer);
+	timer_shutdown_sync(&kqd->timer);
 	blk_stat_disable_accounting(kqd->q);
 
 	for (i = 0; i < KYBER_NUM_DOMAINS; i++)

index f3e4db16fd07..2dc5be89a001 100644
@@ -2184,7 +2184,7 @@ void drbd_destroy_device(struct kref *kref)
 	struct drbd_resource *resource = device->resource;
 	struct drbd_peer_device *peer_device, *tmp_peer_device;
 
-	del_timer_sync(&device->request_timer);
+	timer_shutdown_sync(&device->request_timer);
 
 	/* paranoia asserts */
 	D_ASSERT(device, device->open_cnt == 0);

index ad92192c7d61..3ea087cd1f99 100644
@@ -1755,7 +1755,7 @@ static void lo_free_disk(struct gendisk *disk)
 	if (lo->workqueue)
 		destroy_workqueue(lo->workqueue);
 	loop_free_idle_workers(lo, true);
-	del_timer_sync(&lo->timer);
+	timer_shutdown_sync(&lo->timer);
 	mutex_destroy(&lo->lo_mutex);
 	kfree(lo);
 }

index fb855da971ee..e14fe5d968d8 100644
@@ -1067,7 +1067,7 @@ static void vdc_port_remove(struct vio_dev *vdev)
 
 		flush_work(&port->ldc_reset_work);
 		cancel_delayed_work_sync(&port->ldc_reset_timer_work);
-		del_timer_sync(&port->vio.timer);
+		timer_shutdown_sync(&port->vio.timer);
 
 		del_gendisk(port->disk);
 		put_disk(port->disk);

2.35.1
_______________________________________________
drbd-dev mailing list
[email protected]
https://lists.linbit.com/mailman/listinfo/drbd-dev

From: "Steven Rostedt (Google)" <[email protected]>

We are hitting a common bug were a timer is being triggered after it is freed. This causes a corruption in the timer link list and crashes the kernel. Unfortunately it is not easy to know what timer it was that was freed. Looking at the code, it appears that there are several cases that del_timer() is used when del_timer_sync() should have been.

Add a timer_shutdown_sync() that not only does a del_timer_sync() but will mark the timer as terminated in case it gets rearmed, it will trigger a WARN_ON. The timer_shutdown_sync() is more likely to be used by developers that are about to free a timer, then using del_timer_sync() as the latter is not as obvious to being needed for freeing. Having the word "shutdown" in the name of the function will hopefully help developers know that that function needs to be called before freeing.

The added bonus is the marking of the timer as being freed such that it will trigger a warning if it gets rearmed. At least that way if the system crashes on a freed timer, at least we may see which timer it was that was freed.

There's some situations that already know that the timer is shutdown and does not need to perform the synchronization (or can not due to its context). For these locations there's timer_shutdown() that only shuts down the timer (prevents it from being rearmed) but does not add checks if the timer is currently running.

This code is taken from Thomas Gleixner's "untested" version from my original patch and modified after testing and with some other comments from Linus addressed. As well as some extra comments added.

---
 .../RCU/Design/Requirements/Requirements.rst  |  2 +-
 Documentation/core-api/local_ops.rst          |  2 +-
 Documentation/kernel-hacking/locking.rst      |  5 ++
 include/linux/timer.h                         | 64 +++++++++++++++++--
 kernel/time/timer.c                           | 64 ++++++++++---------
 5 files changed, 98 insertions(+), 39 deletions(-)

index a0f8164c8513..ec6de88846b9 100644
@@ -1858,7 +1858,7 @@ unloaded. After a given module has been unloaded, any attempt to call
 one of its functions results in a segmentation fault. The module-unload
 functions must therefore cancel any delayed calls to loadable-module
 functions, for example, any outstanding mod_timer() must be dealt
-with via del_timer_sync() or similar.
+with via timer_shutdown_sync().
 
 Unfortunately, there is no way to cancel an RCU callback; once you
 invoke call_rcu(), the callback function is eventually going to be

index 2ac3f9f29845..0b42ceaaf3c4 100644
@@ -191,7 +191,7 @@ Here is a sample module which implements a basic per cpu counter using
 
     static void __exit test_exit(void)
     {
-            del_timer_sync(&test_timer);
+            timer_shutdown_sync(&test_timer);
     }
 
     module_init(test_init);

index 6805ae6e86e6..eb341b69fd15 100644
@@ -1009,6 +1009,11 @@ use del_timer_sync() (``include/linux/timer.h``) to
 handle this case. It returns the number of times the timer had to be
 deleted before we finally stopped it from adding itself back in.
 
+Before freeing a timer, timer_shutdown() or timer_shutdown_sync() should be
+called which will keep it from being rearmed, although if it is rearmed, it
+will produce a warning.
+
+
 Locking Speed
 =============
 

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 arch/s390/mm/cmm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 9141ed4c52e9..1a0a8aa43ac6 100644
@@ -419,7 +419,7 @@ static int __init cmm_init(void)
 #endif
 	unregister_sysctl_table(cmm_sysctl_header);
 out_sysctl:
-	del_timer_sync(&cmm_timer);
+	timer_shutdown_sync(&cmm_timer);
 	return rc;
 }
 module_init(cmm_init);

@@ -432,7 +432,7 @@ static void __exit cmm_exit(void)
 #endif
 	unregister_oom_notifier(&cmm_oom_nb);
 	kthread_stop(cmm_thread_ptr);
-	del_timer_sync(&cmm_timer);
+	timer_shutdown_sync(&cmm_timer);
 	cmm_free_pages(cmm_pages, &cmm_pages, &cmm_page_list);
 	cmm_free_pages(cmm_timed_pages, &cmm_timed_pages, &cmm_timed_page_list);
 }

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 arch/sh/drivers/push-switch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 2813140fd92b..c95f48ff3f6f 100644
@@ -102,7 +102,7 @@ static int switch_drv_remove(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, NULL);
 	flush_work(&psw->work);
-	del_timer_sync(&psw->debounce);
+	timer_shutdown_sync(&psw->debounce);
 	free_irq(irq, pdev);
 
 	kfree(psw);

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/acpi/apei/ghes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 9952f3a792ba..9a0e41c21cf9 100644
@@ -1405,7 +1405,7 @@ static int ghes_remove(struct platform_device *ghes_dev)
 	ghes->flags |= GHES_EXITING;
 	switch (generic->notify.type) {
 	case ACPI_HEST_NOTIFY_POLLED:
-		del_timer_sync(&ghes->timer);
+		timer_shutdown_sync(&ghes->timer);
 		break;
 	case ACPI_HEST_NOTIFY_EXTERNAL:
 		free_irq(ghes->irq, ghes);

2.35.1

BR, Jarkko

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/atm/idt77105.c | 4 ++--
 drivers/atm/idt77252.c | 4 ++--
 drivers/atm/iphase.c   | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

index bfca7b8a6f31..cc4a5449ca42 100644
@@ -366,8 +366,8 @@ EXPORT_SYMBOL(idt77105_init);
 static void __exit idt77105_exit(void)
 {
 	/* turn off timers */
-	del_timer_sync(&stats_timer);
-	del_timer_sync(&restart_timer);
+	timer_shutdown_sync(&stats_timer);
+	timer_shutdown_sync(&restart_timer);
 }
 
 module_exit(idt77105_exit);

index 681cb3786794..99cae174d558 100644
@@ -2213,7 +2213,7 @@ idt77252_init_ubr(struct idt77252_dev *card, struct vc_map *vc,
 	}
 	spin_unlock_irqrestore(&vc->lock, flags);
 	if (est) {
-		del_timer_sync(&est->timer);
+		timer_shutdown_sync(&est->timer);
 		kfree(est);
 	}
 

@@ -3752,7 +3752,7 @@ static void __exit idt77252_exit(void)
 		card = idt77252_chain;
 		dev = card->atmdev;
 		idt77252_chain = card->next;
-		del_timer_sync(&card->tst_timer);
+		timer_shutdown_sync(&card->tst_timer);
 
 		if (dev->phy->stop)
 			dev->phy->stop(dev);

index 324148686953..9be45d9d66b3 100644
@@ -3280,7 +3280,7 @@ static void __exit ia_module_exit(void)
 {
 	pci_unregister_driver(&ia_driver);
 
-	del_timer_sync(&ia_timer);
+	timer_shutdown_sync(&ia_timer);
 }
 
 module_init(ia_module_init);

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Instead of open coding making the timer look like it was not registered by setting the function pointer to NULL, call timer_shutdown_sync() that does the same thing.

---
 drivers/base/power/wakeup.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

index 7cc0c0cf8eaa..c6d68bdcac68 100644
@@ -202,12 +202,7 @@ void wakeup_source_remove(struct wakeup_source *ws)
 	raw_spin_unlock_irqrestore(&events_lock, flags);
 	synchronize_srcu(&wakeup_srcu);
 
-	del_timer_sync(&ws->timer);
-	/*
-	 * Clear timer.function to make wakeup_source_not_registered() treat
-	 * this wakeup source as not registered.
-	 */
-	ws->timer.function = NULL;
+	timer_shutdown_sync(&ws->timer);
 }
 EXPORT_SYMBOL_GPL(wakeup_source_remove);
 

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/bluetooth/hci_bcsp.c | 2 +-
 drivers/bluetooth/hci_h5.c   | 2 +-
 drivers/bluetooth/hci_qca.c  | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

index cf4a56095817..834b2efaa9bf 100644
@@ -737,7 +737,7 @@ static int bcsp_close(struct hci_uart *hu)
 {
 	struct bcsp_struct *bcsp = hu->priv;
 
-	del_timer_sync(&bcsp->tbcsp);
+	timer_shutdown_sync(&bcsp->tbcsp);
 
 	hu->priv = NULL;
 

index c5a0409ef84f..51f93ff5ebe8 100644
@@ -253,7 +253,7 @@ static int h5_close(struct hci_uart *hu)
 {
 	struct h5 *h5 = hu->priv;
 
-	del_timer_sync(&h5->timer);
+	timer_shutdown_sync(&h5->timer);
 
 	skb_queue_purge(&h5->unack);
 	skb_queue_purge(&h5->rel);

index 8df11016fd51..eb81296b284c 100644
@@ -697,8 +697,8 @@ static int qca_close(struct hci_uart *hu)
 	skb_queue_purge(&qca->txq);
 	skb_queue_purge(&qca->rx_memdump_q);
 	destroy_workqueue(qca->workqueue);
-	del_timer_sync(&qca->tx_idle_timer);
-	del_timer_sync(&qca->wake_retrans_timer);
+	timer_shutdown_sync(&qca->tx_idle_timer);
+	timer_shutdown_sync(&qca->wake_retrans_timer);
 	qca->hu = NULL;
 
 	kfree_skb(qca->rx_skb);

2.35.1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=691944

---Test result---

Test Summary:

CheckPatch                    PASS      2.43 seconds
GitLint                       PASS      1.12 seconds
SubjectPrefix                 PASS      0.94 seconds
BuildKernel                   FAIL      30.74 seconds
BuildKernel32                 FAIL      26.69 seconds
Incremental Build with patchesERROR     0.44 seconds
TestRunner: Setup             PASS      610.85 seconds
TestRunner: l2cap-tester      PASS      19.59 seconds
TestRunner: iso-tester        PASS      19.51 seconds
TestRunner: bnep-tester       PASS      7.81 seconds
TestRunner: mgmt-tester       PASS      122.01 seconds
TestRunner: rfcomm-tester     PASS      12.14 seconds
TestRunner: sco-tester        PASS      11.33 seconds
TestRunner: ioctl-tester      PASS      13.07 seconds
TestRunner: mesh-tester       PASS      9.39 seconds
TestRunner: smp-tester        PASS      11.30 seconds
TestRunner: userchan-tester   PASS      8.11 seconds

Details
##############################
Test: BuildKernel - FAIL - 30.74 seconds
Build Kernel with minimal configuration supports Bluetooth
drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2

##############################
Test: BuildKernel32 - FAIL - 26.69 seconds
Build 32bit Kernel with minimal configuration supports Bluetooth
drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2

##############################
Test: Incremental Build with patches - SKIPPED - 0.44 seconds Incremental build per patch in the series buildkernel failed

---
Regards,
Linux Bluetooth

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=691944

---Test result---

Test Summary:

CheckPatch                    PASS      0.99 seconds
GitLint                       PASS      0.26 seconds
SubjectPrefix                 PASS      0.06 seconds
BuildKernel                   FAIL      34.26 seconds
BuildKernel32                 FAIL      29.73 seconds
TestRunnerSetup               PASS      569.36 seconds
TestRunner_l2cap-tester       PASS      19.51 seconds
TestRunner_iso-tester         PASS      20.54 seconds
TestRunner_bnep-tester        PASS      7.18 seconds
TestRunner_mgmt-tester        PASS      134.11 seconds
TestRunner_rfcomm-tester      PASS      11.97 seconds
TestRunner_sco-tester         PASS      11.11 seconds
TestRunner_ioctl-tester       PASS      12.96 seconds
TestRunner_mesh-tester        PASS      8.97 seconds
TestRunner_smp-tester         PASS      10.73 seconds
TestRunner_userchan-tester    PASS      7.42 seconds
IncrementalBuild              FAIL      31.67 seconds

Details
##############################
Test: BuildKernel - FAIL
Desc: Build Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: BuildKernel32 - FAIL
Desc: Build 32bit Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
[RFC,v3,08/33] timers: Bluetooth: Use timer_shutdown_sync() before freeing timer

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2

---
Regards,
Linux Bluetooth

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=691944

---Test result---

Test Summary:

CheckPatch                    PASS      1.13 seconds
GitLint                       PASS      0.34 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   FAIL      36.83 seconds
BuildKernel32                 FAIL      31.55 seconds
TestRunnerSetup               PASS      597.91 seconds
TestRunner_l2cap-tester       PASS      19.89 seconds
TestRunner_iso-tester         PASS      21.63 seconds
TestRunner_bnep-tester        PASS      7.37 seconds
TestRunner_mgmt-tester        PASS      140.75 seconds
TestRunner_rfcomm-tester      PASS      12.18 seconds
TestRunner_sco-tester         PASS      11.41 seconds
TestRunner_ioctl-tester       PASS      13.39 seconds
TestRunner_mesh-tester        PASS      9.45 seconds
TestRunner_smp-tester         PASS      11.18 seconds
TestRunner_userchan-tester    PASS      7.77 seconds
IncrementalBuild              FAIL      32.49 seconds

Details
##############################
Test: BuildKernel - FAIL
Desc: Build Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: BuildKernel32 - FAIL
Desc: Build 32bit Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
[RFC,v3,08/33] timers: Bluetooth: Use timer_shutdown_sync() before freeing timer

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2

---
Regards,
Linux Bluetooth

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=691944

---Test result---

Test Summary:

CheckPatch                    PASS      0.87 seconds
GitLint                       PASS      0.27 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   FAIL      25.00 seconds
BuildKernel32                 FAIL      21.48 seconds
TestRunnerSetup               PASS      416.60 seconds
TestRunner_l2cap-tester       PASS      15.65 seconds
TestRunner_iso-tester         PASS      14.99 seconds
TestRunner_bnep-tester        PASS      5.25 seconds
TestRunner_mgmt-tester        PASS      102.39 seconds
TestRunner_rfcomm-tester      PASS      9.06 seconds
TestRunner_sco-tester         PASS      8.49 seconds
TestRunner_ioctl-tester       PASS      9.63 seconds
TestRunner_mesh-tester        PASS      6.62 seconds
TestRunner_smp-tester         PASS      8.40 seconds
TestRunner_userchan-tester    PASS      5.53 seconds
IncrementalBuild              FAIL      23.20 seconds

Details
##############################
Test: BuildKernel - FAIL
Desc: Build Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: BuildKernel32 - FAIL
Desc: Build 32bit Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
[RFC,v3,08/33] timers: Bluetooth: Use timer_shutdown_sync() before freeing timer

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2

---
Regards,
Linux Bluetooth

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=691944

---Test result---

Test Summary:

CheckPatch                    PASS      0.98 seconds
GitLint                       PASS      0.36 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   FAIL      26.81 seconds
BuildKernel32                 FAIL      22.99 seconds
TestRunnerSetup               PASS      434.31 seconds
TestRunner_l2cap-tester       PASS      16.09 seconds
TestRunner_iso-tester         PASS      15.92 seconds
TestRunner_bnep-tester        PASS      5.60 seconds
TestRunner_mgmt-tester        PASS      108.14 seconds
TestRunner_rfcomm-tester      PASS      9.53 seconds
TestRunner_sco-tester         PASS      8.92 seconds
TestRunner_ioctl-tester       PASS      10.24 seconds
TestRunner_mesh-tester        PASS      7.09 seconds
TestRunner_smp-tester         PASS      8.72 seconds
TestRunner_userchan-tester    PASS      5.94 seconds
IncrementalBuild              FAIL      24.53 seconds

Details
##############################
Test: BuildKernel - FAIL
Desc: Build Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: BuildKernel32 - FAIL
Desc: Build 32bit Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
[RFC,v3,08/33] timers: Bluetooth: Use timer_shutdown_sync() before freeing timer

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2

---
Regards,
Linux Bluetooth

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=691944

---Test result---

Test Summary:

CheckPatch                    PASS      0.88 seconds
GitLint                       PASS      0.29 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   FAIL      25.87 seconds
BuildKernel32                 FAIL      22.07 seconds
TestRunnerSetup               PASS      424.01 seconds
TestRunner_l2cap-tester       PASS      16.06 seconds
TestRunner_iso-tester         PASS      15.75 seconds
TestRunner_bnep-tester        PASS      5.50 seconds
TestRunner_mgmt-tester        PASS      107.14 seconds
TestRunner_rfcomm-tester      PASS      9.48 seconds
TestRunner_sco-tester         PASS      8.92 seconds
TestRunner_ioctl-tester       PASS      10.15 seconds
TestRunner_mesh-tester        PASS      7.01 seconds
TestRunner_smp-tester         PASS      8.73 seconds
TestRunner_userchan-tester    PASS      5.78 seconds
IncrementalBuild              FAIL      24.00 seconds

Details
##############################
Test: BuildKernel - FAIL
Desc: Build Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: BuildKernel32 - FAIL
Desc: Build 32bit Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
[RFC,v3,08/33] timers: Bluetooth: Use timer_shutdown_sync() before freeing timer

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2

---
Regards,
Linux Bluetooth

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=691944

---Test result---

Test Summary:

CheckPatch                    PASS      0.97 seconds
GitLint                       PASS      0.35 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   FAIL      26.09 seconds
BuildKernel32                 FAIL      22.39 seconds
TestRunnerSetup               PASS      427.32 seconds
TestRunner_l2cap-tester       PASS      16.10 seconds
TestRunner_iso-tester         PASS      15.59 seconds
TestRunner_bnep-tester        PASS      5.58 seconds
TestRunner_mgmt-tester        PASS      106.73 seconds
TestRunner_rfcomm-tester      PASS      9.51 seconds
TestRunner_sco-tester         PASS      8.91 seconds
TestRunner_ioctl-tester       PASS      10.25 seconds
TestRunner_mesh-tester        PASS      7.03 seconds
TestRunner_smp-tester         PASS      8.92 seconds
TestRunner_userchan-tester    PASS      5.86 seconds
IncrementalBuild              FAIL      24.21 seconds

Details
##############################
Test: BuildKernel - FAIL
Desc: Build Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: BuildKernel32 - FAIL
Desc: Build 32bit Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
[RFC,v3,08/33] timers: Bluetooth: Use timer_shutdown_sync() before freeing timer

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2

---
Regards,
Linux Bluetooth

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=691944

---Test result---

Test Summary:

CheckPatch                    PASS      0.89 seconds
GitLint                       PASS      0.28 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   FAIL      25.81 seconds
BuildKernel32                 FAIL      21.97 seconds
TestRunnerSetup               PASS      421.30 seconds
TestRunner_l2cap-tester       PASS      15.70 seconds
TestRunner_iso-tester         PASS      14.99 seconds
TestRunner_bnep-tester        PASS      5.35 seconds
TestRunner_mgmt-tester        PASS      103.40 seconds
TestRunner_rfcomm-tester      PASS      9.12 seconds
TestRunner_sco-tester         PASS      8.62 seconds
TestRunner_ioctl-tester       PASS      9.78 seconds
TestRunner_mesh-tester        PASS      6.65 seconds
TestRunner_smp-tester         PASS      8.33 seconds
TestRunner_userchan-tester    PASS      5.50 seconds
IncrementalBuild              FAIL      23.21 seconds

Details
##############################
Test: BuildKernel - FAIL
Desc: Build Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: BuildKernel32 - FAIL
Desc: Build 32bit Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
[RFC,v3,08/33] timers: Bluetooth: Use timer_shutdown_sync() before freeing timer

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2

---
Regards,
Linux Bluetooth

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=691944

---Test result---

Test Summary:

CheckPatch                    PASS      1.01 seconds
GitLint                       PASS      0.35 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   FAIL      27.41 seconds
BuildKernel32                 FAIL      23.48 seconds
TestRunnerSetup               PASS      450.44 seconds
TestRunner_l2cap-tester       PASS      16.19 seconds
TestRunner_iso-tester         PASS      16.32 seconds
TestRunner_bnep-tester        PASS      5.64 seconds
TestRunner_mgmt-tester        PASS      109.08 seconds
TestRunner_rfcomm-tester      PASS      9.54 seconds
TestRunner_sco-tester         PASS      9.00 seconds
TestRunner_ioctl-tester       PASS      10.33 seconds
TestRunner_mesh-tester        PASS      7.15 seconds
TestRunner_smp-tester         PASS      8.96 seconds
TestRunner_userchan-tester    PASS      5.87 seconds
IncrementalBuild              FAIL      25.29 seconds

Details
##############################
Test: BuildKernel - FAIL
Desc: Build Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: BuildKernel32 - FAIL
Desc: Build 32bit Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
[RFC,v3,08/33] timers: Bluetooth: Use timer_shutdown_sync() before freeing timer

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2

---
Regards,
Linux Bluetooth

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=691944

---Test result---

Test Summary:

CheckPatch                    PASS      1.06 seconds
GitLint                       PASS      0.32 seconds
SubjectPrefix                 PASS      0.10 seconds
BuildKernel                   FAIL      30.45 seconds
BuildKernel32                 FAIL      26.44 seconds
TestRunnerSetup               PASS      498.94 seconds
TestRunner_l2cap-tester       PASS      17.86 seconds
TestRunner_iso-tester         PASS      18.18 seconds
TestRunner_bnep-tester        PASS      6.47 seconds
TestRunner_mgmt-tester        PASS      120.72 seconds
TestRunner_rfcomm-tester      PASS      10.89 seconds
TestRunner_sco-tester         PASS      9.95 seconds
TestRunner_ioctl-tester       PASS      11.68 seconds
TestRunner_mesh-tester        PASS      8.22 seconds
TestRunner_smp-tester         PASS      9.93 seconds
TestRunner_userchan-tester    PASS      6.89 seconds
IncrementalBuild              FAIL      28.52 seconds

Details
##############################
Test: BuildKernel - FAIL
Desc: Build Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: BuildKernel32 - FAIL
Desc: Build 32bit Kernel for Bluetooth
Output:

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
[RFC,v3,08/33] timers: Bluetooth: Use timer_shutdown_sync() before freeing timer

drivers/bluetooth/hci_bcsp.c: In function ‘bcsp_close’:
drivers/bluetooth/hci_bcsp.c:740:2: error: implicit declaration of function ‘timer_shutdown_sync’ [-Werror=implicit-function-declaration]

  740 |  timer_shutdown_sync(&bcsp->tbcsp);
      |  ^~~~~~~~~~~~~~~~~~~

cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:249: drivers/bluetooth/hci_bcsp.o] Error 1 make[2]: *** Waiting for unfinished jobs....
make[1]: *** [scripts/Makefile.build:465: drivers/bluetooth] Error 2
make: *** [Makefile:1852: drivers] Error 2

---
Regards,
Linux Bluetooth

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

Also fixed some whitespace issues in the line after.

---
 drivers/char/hangcheck-timer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 4181bcc1c796..783a86bfca69 100644
@@ -167,8 +167,8 @@ static int __init hangcheck_init(void)
 
 static void __exit hangcheck_exit(void)
 {
-	del_timer_sync(&hangcheck_ticktock);
-        printk("Hangcheck: Stopped hangcheck timer.\n");
+	timer_shutdown_sync(&hangcheck_ticktock);
+	printk("Hangcheck: Stopped hangcheck timer.\n");
 }
 
 module_init(hangcheck_init);

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/char/ipmi/ipmi_msghandler.c | 2 +-
 drivers/char/ipmi/ipmi_ssif.c       | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

index 49a1707693c9..5cfb85e22d65 100644
@@ -5540,7 +5540,7 @@ static void __exit cleanup_ipmi(void)
 		 * here.
 		 */
 		atomic_set(&stop_operation, 1);
-		del_timer_sync(&ipmi_timer);
+		timer_shutdown_sync(&ipmi_timer);
 
 		initialized = false;
 

index e1072809fe31..5194be6d0639 100644
@@ -1273,8 +1273,8 @@ static void shutdown_ssif(void *send_info)
 		schedule_timeout(1);
 
 	ssif_info->stopping = true;
-	del_timer_sync(&ssif_info->watch_timer);
-	del_timer_sync(&ssif_info->retry_timer);
+	timer_shutdown_sync(&ssif_info->watch_timer);
+	timer_shutdown_sync(&ssif_info->retry_timer);
 	if (ssif_info->thread) {
 		complete(&ssif_info->wake_thread);
 		kthread_stop(ssif_info->thread);

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/char/random.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 69754155300e..943b4b2712a5 100644
@@ -1233,7 +1233,7 @@ static void __cold try_to_generate_entropy(void)
 		stack.entropy = random_get_entropy();
 	}
 
-	del_timer_sync(&stack.timer);
+	timer_shutdown_sync(&stack.timer);
 	destroy_timer_on_stack(&stack.timer);
 	mix_pool_bytes(&stack.entropy, sizeof(stack.entropy));
 }

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/dma-buf/st-dma-fence.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index fb6e0a6ae2c9..5d3e7b503501 100644
@@ -412,7 +412,7 @@ static int test_wait_timeout(void *arg)
 
 	err = 0;
 err_free:
-	del_timer_sync(&wt.timer);
+	timer_shutdown_sync(&wt.timer);
 	destroy_timer_on_stack(&wt.timer);
 	dma_fence_signal(wt.f);
 	dma_fence_put(wt.f);

2.35.1

[ Once again, quilt fails the MIME coding ]

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/dma-buf/st-dma-fence.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index fb6e0a6ae2c9..5d3e7b503501 100644
@@ -412,7 +412,7 @@ static int test_wait_timeout(void *arg)
 
 	err = 0;
 err_free:
-	del_timer_sync(&wt.timer);
+	timer_shutdown_sync(&wt.timer);
 	destroy_timer_on_stack(&wt.timer);
 	dma_fence_signal(wt.f);
 	dma_fence_put(wt.f);

2.35.1

Am 04.11.22 um 06:54 schrieb Steven Rostedt:

Timers are more often re-armed then not. I had to look for the locations where del_timer*() was called just before freeing, and other locations where they are freed later.

I didn't rename del_timer_sync() to timer_shutdown_sync(), this version renamed the new "del_timer_shutdown()" to "timer_shutdown_sync()".

Maybe I'm just confused at what you are asking.

-- Steve

Am 04.11.22 um 19:58 schrieb Steven Rostedt:

No, that explains it a bit better. I was just wondering what exactly the different to del_timer_sync() is.

Maybe shorten the summary in the cover letter a bit. The history how this change came to be is not as interesting as why we are changing something.

Regards,
Christian.

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/gpu/drm/gud/gud_pipe.c       | 2 +-
 drivers/gpu/drm/i915/i915_sw_fence.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

index 7c6dc2bcd14a..08429bdd57cf 100644
@@ -272,7 +272,7 @@ static int gud_usb_bulk(struct gud_device *gdrm, size_t len)
 
 	usb_sg_wait(&ctx.sgr);
 
-	if (!del_timer_sync(&ctx.timer))
+	if (!timer_shutdown_sync(&ctx.timer))
 		ret = -ETIMEDOUT;
 	else if (ctx.sgr.status < 0)
 		ret = ctx.sgr.status;

index 6fc0d1b89690..bfaa9a67dc35 100644
@@ -465,7 +465,7 @@ static void irq_i915_sw_fence_work(struct irq_work *wrk)
 	struct i915_sw_dma_fence_cb_timer *cb =
 		container_of(wrk, typeof(*cb), work);
 
-	del_timer_sync(&cb->timer);
+	timer_shutdown_sync(&cb->timer);
 	dma_fence_put(cb->dma);
 
 	kfree_rcu(cb, rcu);

2.35.1

[ Once again, quilt fails the MIME coding ]

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/gpu/drm/gud/gud_pipe.c       | 2 +-
 drivers/gpu/drm/i915/i915_sw_fence.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

index 7c6dc2bcd14a..08429bdd57cf 100644
@@ -272,7 +272,7 @@ static int gud_usb_bulk(struct gud_device *gdrm, size_t len)
 
 	usb_sg_wait(&ctx.sgr);
 
-	if (!del_timer_sync(&ctx.timer))
+	if (!timer_shutdown_sync(&ctx.timer))
 		ret = -ETIMEDOUT;
 	else if (ctx.sgr.status < 0)
 		ret = ctx.sgr.status;

index 6fc0d1b89690..bfaa9a67dc35 100644
@@ -465,7 +465,7 @@ static void irq_i915_sw_fence_work(struct irq_work *wrk)
 	struct i915_sw_dma_fence_cb_timer *cb =
 		container_of(wrk, typeof(*cb), work);
 
-	del_timer_sync(&cb->timer);
+	timer_shutdown_sync(&cb->timer);
 	dma_fence_put(cb->dma);
 
 	kfree_rcu(cb, rcu);

2.35.1

Hi,

If it stays all DRM drivers in one patch then I guess it needs to go via drm-misc, which for i915 would be okay I think in this case since patch is extremely unlikely to clash with anything. Or split it up per driver and then we can handle it in drm-intel-next once core functionality is in.

We do however have some more calls to del_timer_sync, where freeing is perhaps not immediately next to the site in code, but things definitely get freed like on module unload. Would we need to convert all of them to avoid some, presumably new, warnings?

Regards,

Tvrtko

I'm happy to split this patch up. I just got a bit lazy and started just grouping via entire subsystems. You should see the networking patch ;-)

-- Steve

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/hid/hid-wiimote-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 4399d6c6afef..2c94308dda3c 100644
@@ -1764,7 +1764,7 @@ static void wiimote_destroy(struct wiimote_data *wdata)
 	spin_unlock_irqrestore(&wdata->state.lock, flags);
 
 	cancel_work_sync(&wdata->init_worker);
-	del_timer_sync(&wdata->timer);
+	timer_shutdown_sync(&wdata->timer);
 
 	device_remove_file(&wdata->hdev->dev, &dev_attr_devtype);
 	device_remove_file(&wdata->hdev->dev, &dev_attr_extension);

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called, or at least timer_shutdown() (where sync is not possible in the context).

---
 drivers/isdn/hardware/mISDN/hfcmulti.c | 6 ++----
 drivers/isdn/mISDN/l1oip_core.c        | 4 ++--
 drivers/isdn/mISDN/timerdev.c          | 4 ++--
 3 files changed, 6 insertions(+), 8 deletions(-)

index 4f7eaa17fb27..9c15c2c30e88 100644
@@ -4543,10 +4543,8 @@ release_port(struct hfc_multi *hc, struct dchannel *dch)
 
 	spin_lock_irqsave(&hc->lock, flags);
 
-	if (dch->timer.function) {
-		del_timer(&dch->timer);
-		dch->timer.function = NULL;
-	}
+	if (dch->timer.function)
+		timer_shutdown(&dch->timer);
 
 	if (hc->ctype == HFC_TYPE_E1) { /* E1 */
 		/* remove sync */

index a77195e378b7..182e3f489c60 100644
@@ -1236,8 +1236,8 @@ release_card(struct l1oip *hc)
 
 	hc->shutdown = true;
 
-	del_timer_sync(&hc->keep_tl);
-	del_timer_sync(&hc->timeout_tl);
+	timer_shutdown_sync(&hc->keep_tl);
+	timer_shutdown_sync(&hc->timeout_tl);
 
 	cancel_work_sync(&hc->workq);
 

index abdf36ac3bee..83d6b484d3c6 100644
@@ -74,7 +74,7 @@ mISDN_close(struct inode *ino, struct file *filep)
 	while (!list_empty(list)) {
 		timer = list_first_entry(list, struct mISDNtimer, list);
 		spin_unlock_irq(&dev->lock);
-		del_timer_sync(&timer->tl);
+		timer_shutdown_sync(&timer->tl);
 		spin_lock_irq(&dev->lock);
 		/* it might have been moved to ->expired */
 		list_del(&timer->list);

@@ -204,7 +204,7 @@ misdn_del_timer(struct mISDNtimerdev *dev, int id)
 			list_del_init(&timer->list);
 			timer->id = -1;
 			spin_unlock_irq(&dev->lock);
-			del_timer_sync(&timer->tl);
+			timer_shutdown_sync(&timer->tl);
 			kfree(timer);
 			return id;
 		}

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/leds/trigger/ledtrig-activity.c  | 2 +-
 drivers/leds/trigger/ledtrig-heartbeat.c | 2 +-
 drivers/leds/trigger/ledtrig-pattern.c   | 2 +-
 drivers/leds/trigger/ledtrig-transient.c | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

index 30bc9df03636..33cbf8413658 100644
@@ -208,7 +208,7 @@ static void activity_deactivate(struct led_classdev *led_cdev)
 {
 	struct activity_data *activity_data = led_get_trigger_data(led_cdev);
 
-	del_timer_sync(&activity_data->timer);
+	timer_shutdown_sync(&activity_data->timer);
 	kfree(activity_data);
 	clear_bit(LED_BLINK_SW, &led_cdev->work_flags);
 }

index 7fe0a05574d2..393b3ae832f4 100644
@@ -151,7 +151,7 @@ static void heartbeat_trig_deactivate(struct led_classdev *led_cdev)
 	struct heartbeat_trig_data *heartbeat_data =
 		led_get_trigger_data(led_cdev);
 
-	del_timer_sync(&heartbeat_data->timer);
+	timer_shutdown_sync(&heartbeat_data->timer);
 	kfree(heartbeat_data);
 	clear_bit(LED_BLINK_SW, &led_cdev->work_flags);
 }

index 43a265dc4696..e996d61e3bd6 100644
@@ -430,7 +430,7 @@ static void pattern_trig_deactivate(struct led_classdev *led_cdev)
 	if (led_cdev->pattern_clear)
 		led_cdev->pattern_clear(led_cdev);
 
-	del_timer_sync(&data->timer);
+	timer_shutdown_sync(&data->timer);
 
 	led_set_brightness(led_cdev, LED_OFF);
 	kfree(data);

index 80635183fac8..f111fa7635e5 100644
@@ -180,7 +180,7 @@ static void transient_trig_deactivate(struct led_classdev *led_cdev)
 {
 	struct transient_trig_data *transient_data = led_get_trigger_data(led_cdev);
 
-	del_timer_sync(&transient_data->timer);
+	timer_shutdown_sync(&transient_data->timer);
 	led_set_brightness_nosleep(led_cdev, transient_data->restore_state);
 	kfree(transient_data);
 }

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/media/pci/ivtv/ivtv-driver.c           |  2 +-
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c        | 18 +++++++++---------
 drivers/media/usb/s2255/s2255drv.c             |  4 ++--
 .../staging/media/atomisp/i2c/atomisp-lm3554.c |  2 +-
 4 files changed, 13 insertions(+), 13 deletions(-)

index f5846c22c799..ba503d820e48 100644
@@ -1425,7 +1425,7 @@ static void ivtv_remove(struct pci_dev *pdev)
 
 	/* Interrupts */
 	ivtv_set_irq_mask(itv, 0xffffffff);
-	del_timer_sync(&itv->dma_timer);
+	timer_shutdown_sync(&itv->dma_timer);
 
 	/* Kill irq worker */
 	kthread_flush_worker(&itv->irq_worker);

index 62ff1fa1c753..db000c9145d7 100644
@@ -2605,10 +2605,10 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
 	return hdw;
  fail:
 	if (hdw) {
-		del_timer_sync(&hdw->quiescent_timer);
-		del_timer_sync(&hdw->decoder_stabilization_timer);
-		del_timer_sync(&hdw->encoder_run_timer);
-		del_timer_sync(&hdw->encoder_wait_timer);
+		timer_shutdown_sync(&hdw->quiescent_timer);
+		timer_shutdown_sync(&hdw->decoder_stabilization_timer);
+		timer_shutdown_sync(&hdw->encoder_run_timer);
+		timer_shutdown_sync(&hdw->encoder_wait_timer);
 		flush_work(&hdw->workpoll);
 		v4l2_device_unregister(&hdw->v4l2_dev);
 		usb_free_urb(hdw->ctl_read_urb);

@@ -2668,10 +2668,10 @@ void pvr2_hdw_destroy(struct pvr2_hdw *hdw)
 	if (!hdw) return;
 	pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_destroy: hdw=%p",hdw);
 	flush_work(&hdw->workpoll);
-	del_timer_sync(&hdw->quiescent_timer);
-	del_timer_sync(&hdw->decoder_stabilization_timer);
-	del_timer_sync(&hdw->encoder_run_timer);
-	del_timer_sync(&hdw->encoder_wait_timer);
+	timer_shutdown_sync(&hdw->quiescent_timer);
+	timer_shutdown_sync(&hdw->decoder_stabilization_timer);
+	timer_shutdown_sync(&hdw->encoder_run_timer);
+	timer_shutdown_sync(&hdw->encoder_wait_timer);
 	if (hdw->fw_buffer) {
 		kfree(hdw->fw_buffer);
 		hdw->fw_buffer = NULL;

@@ -3722,7 +3722,7 @@ status);
 	hdw->cmd_debug_state = 5;
 
 	/* Stop timer */
-	del_timer_sync(&timer.timer);
+	timer_shutdown_sync(&timer.timer);
 
 	hdw->cmd_debug_state = 6;
 	status = 0;

index acf18e2251a5..3c2627712fe9 100644
@@ -1487,7 +1487,7 @@ static void s2255_destroy(struct s2255_dev *dev)
 	/* board shutdown stops the read pipe if it is running */
 	s2255_board_shutdown(dev);
 	/* make sure firmware still not trying to load */
-	del_timer_sync(&dev->timer);  /* only started in .probe and .open */
+	timer_shutdown_sync(&dev->timer);  /* only started in .probe and .open */
 	if (dev->fw_data->fw_urb) {
 		usb_kill_urb(dev->fw_data->fw_urb);
 		usb_free_urb(dev->fw_data->fw_urb);

@@ -2322,7 +2322,7 @@ static int s2255_probe(struct usb_interface *interface,
 errorFWDATA2:
 	usb_free_urb(dev->fw_data->fw_urb);
 errorFWURB:
-	del_timer_sync(&dev->timer);
+	timer_shutdown_sync(&dev->timer);
 errorEP:
 	usb_put_dev(dev->udev);
 errorUDEV:

index 75d16b525294..c4ce4cd445d7 100644
@@ -921,7 +921,7 @@ static void lm3554_remove(struct i2c_client *client)
 
 	atomisp_gmin_remove_subdev(sd);
 
-	del_timer_sync(&flash->flash_off_delay);
+	timer_shutdown_sync(&flash->flash_off_delay);
 
 	lm3554_gpio_uninit(client);
 

2.35.1

[ Once again, quilt fails the MIME coding ]

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/media/pci/ivtv/ivtv-driver.c           |  2 +-
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c        | 18 +++++++++---------
 drivers/media/usb/s2255/s2255drv.c             |  4 ++--
 .../staging/media/atomisp/i2c/atomisp-lm3554.c |  2 +-
 4 files changed, 13 insertions(+), 13 deletions(-)

index f5846c22c799..ba503d820e48 100644
@@ -1425,7 +1425,7 @@ static void ivtv_remove(struct pci_dev *pdev)
 
 	/* Interrupts */
 	ivtv_set_irq_mask(itv, 0xffffffff);
-	del_timer_sync(&itv->dma_timer);
+	timer_shutdown_sync(&itv->dma_timer);
 
 	/* Kill irq worker */
 	kthread_flush_worker(&itv->irq_worker);

index 62ff1fa1c753..db000c9145d7 100644
@@ -2605,10 +2605,10 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
 	return hdw;
  fail:
 	if (hdw) {
-		del_timer_sync(&hdw->quiescent_timer);
-		del_timer_sync(&hdw->decoder_stabilization_timer);
-		del_timer_sync(&hdw->encoder_run_timer);
-		del_timer_sync(&hdw->encoder_wait_timer);
+		timer_shutdown_sync(&hdw->quiescent_timer);
+		timer_shutdown_sync(&hdw->decoder_stabilization_timer);
+		timer_shutdown_sync(&hdw->encoder_run_timer);
+		timer_shutdown_sync(&hdw->encoder_wait_timer);
 		flush_work(&hdw->workpoll);
 		v4l2_device_unregister(&hdw->v4l2_dev);
 		usb_free_urb(hdw->ctl_read_urb);

@@ -2668,10 +2668,10 @@ void pvr2_hdw_destroy(struct pvr2_hdw *hdw)
 	if (!hdw) return;
 	pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_destroy: hdw=%p",hdw);
 	flush_work(&hdw->workpoll);
-	del_timer_sync(&hdw->quiescent_timer);
-	del_timer_sync(&hdw->decoder_stabilization_timer);
-	del_timer_sync(&hdw->encoder_run_timer);
-	del_timer_sync(&hdw->encoder_wait_timer);
+	timer_shutdown_sync(&hdw->quiescent_timer);
+	timer_shutdown_sync(&hdw->decoder_stabilization_timer);
+	timer_shutdown_sync(&hdw->encoder_run_timer);
+	timer_shutdown_sync(&hdw->encoder_wait_timer);
 	if (hdw->fw_buffer) {
 		kfree(hdw->fw_buffer);
 		hdw->fw_buffer = NULL;

@@ -3722,7 +3722,7 @@ status);
 	hdw->cmd_debug_state = 5;
 
 	/* Stop timer */
-	del_timer_sync(&timer.timer);
+	timer_shutdown_sync(&timer.timer);
 
 	hdw->cmd_debug_state = 6;
 	status = 0;

index acf18e2251a5..3c2627712fe9 100644
@@ -1487,7 +1487,7 @@ static void s2255_destroy(struct s2255_dev *dev)
 	/* board shutdown stops the read pipe if it is running */
 	s2255_board_shutdown(dev);
 	/* make sure firmware still not trying to load */
-	del_timer_sync(&dev->timer);  /* only started in .probe and .open */
+	timer_shutdown_sync(&dev->timer);  /* only started in .probe and .open */
 	if (dev->fw_data->fw_urb) {
 		usb_kill_urb(dev->fw_data->fw_urb);
 		usb_free_urb(dev->fw_data->fw_urb);

@@ -2322,7 +2322,7 @@ static int s2255_probe(struct usb_interface *interface,
 errorFWDATA2:
 	usb_free_urb(dev->fw_data->fw_urb);
 errorFWURB:
-	del_timer_sync(&dev->timer);
+	timer_shutdown_sync(&dev->timer);
 errorEP:
 	usb_put_dev(dev->udev);
 errorUDEV:

index 75d16b525294..c4ce4cd445d7 100644
@@ -921,7 +921,7 @@ static void lm3554_remove(struct i2c_client *client)
 
 	atomisp_gmin_remove_subdev(sd);
 
-	del_timer_sync(&flash->flash_off_delay);
+	timer_shutdown_sync(&flash->flash_off_delay);
 
 	lm3554_gpio_uninit(client);
 

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

And if synchronization is already done, then at least timer_shutdown() needs to be called.

---
 drivers/net/ethernet/intel/i40e/i40e_main.c      | 6 +++---
 drivers/net/ethernet/marvell/sky2.c              | 2 +-
 drivers/net/ethernet/sun/sunvnet.c               | 2 +-
 drivers/net/usb/sierra_net.c                     | 2 +-
 drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 2 +-
 drivers/net/wireless/intersil/hostap/hostap_ap.c | 2 +-
 drivers/net/wireless/marvell/mwifiex/main.c      | 2 +-
 drivers/net/wireless/microchip/wilc1000/hif.c    | 8 ++++----
 net/802/garp.c                                   | 2 +-
 net/802/mrp.c                                    | 2 +-
 net/bridge/br_multicast.c                        | 6 +++---
 net/bridge/br_multicast_eht.c                    | 4 ++--
 net/core/gen_estimator.c                         | 2 +-
 net/core/neighbour.c                             | 2 ++
 net/ipv4/inet_connection_sock.c                  | 2 +-
 net/ipv4/inet_timewait_sock.c                    | 3 ++-
 net/ipv4/ipmr.c                                  | 2 +-
 net/ipv6/ip6mr.c                                 | 2 +-
 net/mac80211/mesh_pathtbl.c                      | 2 +-
 net/netfilter/ipset/ip_set_list_set.c            | 2 +-
 net/netfilter/ipvs/ip_vs_lblc.c                  | 2 +-
 net/netfilter/ipvs/ip_vs_lblcr.c                 | 2 +-
 net/netfilter/xt_LED.c                           | 2 +-
 net/rxrpc/conn_object.c                          | 2 +-
 net/sched/cls_flow.c                             | 2 +-
 net/sunrpc/svc.c                                 | 2 +-
 net/sunrpc/xprt.c                                | 2 +-
 net/tipc/discover.c                              | 2 +-
 net/tipc/monitor.c                               | 2 +-
 29 files changed, 39 insertions(+), 36 deletions(-)

index b5dcd15ced36..54d5eed32743 100644
@@ -15530,7 +15530,7 @@ static int i40e_init_recovery_mode(struct i40e_pf *pf, struct i40e_hw *hw)
 
 err_switch_setup:
 	i40e_reset_interrupt_capability(pf);
-	del_timer_sync(&pf->service_timer);
+	timer_shutdown_sync(&pf->service_timer);
 	i40e_shutdown_adminq(hw);
 	iounmap(hw->hw_addr);
 	pci_disable_pcie_error_reporting(pf->pdev);

@@ -16149,7 +16149,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	kfree(pf->vsi);
 err_switch_setup:
 	i40e_reset_interrupt_capability(pf);
-	del_timer_sync(&pf->service_timer);
+	timer_shutdown_sync(&pf->service_timer);
 err_mac_addr:
 err_configure_lan_hmc:
 	(void)i40e_shutdown_lan_hmc(hw);

@@ -16211,7 +16211,7 @@ static void i40e_remove(struct pci_dev *pdev)
 	set_bit(__I40E_SUSPENDED, pf->state);
 	set_bit(__I40E_DOWN, pf->state);
 	if (pf->service_timer.function)
-		del_timer_sync(&pf->service_timer);
+		timer_shutdown_sync(&pf->service_timer);
 	if (pf->service_task.func)
 		cancel_work_sync(&pf->service_task);
 

index ab33ba1c3023..dc571e076180 100644
@@ -5013,7 +5013,7 @@ static void sky2_remove(struct pci_dev *pdev)
 	if (!hw)
 		return;
 
-	del_timer_sync(&hw->watchdog_timer);
+	timer_shutdown_sync(&hw->watchdog_timer);
 	cancel_work_sync(&hw->restart_work);
 
 	for (i = hw->ports-1; i >= 0; --i)

index acda6cbd0238..fe86fbd58586 100644
@@ -524,7 +524,7 @@ static void vnet_port_remove(struct vio_dev *vdev)
 		hlist_del_rcu(&port->hash);
 
 		synchronize_rcu();
-		del_timer_sync(&port->clean_timer);
+		timer_shutdown_sync(&port->clean_timer);
 		sunvnet_port_rm_txq_common(port);
 		netif_napi_del(&port->napi);
 		sunvnet_port_free_tx_bufs_common(port);

index b3ae949e6f1c..673d3aa83792 100644
@@ -759,7 +759,7 @@ static void sierra_net_unbind(struct usbnet *dev, struct usb_interface *intf)
 	dev_dbg(&dev->udev->dev, "%s", __func__);
 
 	/* kill the timer and work */
-	del_timer_sync(&priv->sync_timer);
+	timer_shutdown_sync(&priv->sync_timer);
 	cancel_work_sync(&priv->sierra_net_kevent);
 
 	/* tell modem we are going away */

index 3237d4b528b5..119d83acafd1 100644
@@ -371,7 +371,7 @@ void iwl_dbg_tlv_del_timers(struct iwl_trans *trans)
 	struct iwl_dbg_tlv_timer_node *node, *tmp;
 
 	list_for_each_entry_safe(node, tmp, timer_list, list) {
-		del_timer_sync(&node->timer);
+		timer_shutdown_sync(&node->timer);
 		list_del(&node->list);
 		kfree(node);
 	}

index 462ccc7d7d1a..9b546a71e7a2 100644
@@ -135,7 +135,7 @@ static void ap_free_sta(struct ap_data *ap, struct sta_info *sta)
 
 	if (!sta->ap)
 		kfree(sta->u.sta.challenge);
-	del_timer_sync(&sta->timer);
+	timer_shutdown_sync(&sta->timer);
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
 
 	kfree(sta);

index da2e6557e684..ea22a08e6c08 100644
@@ -123,7 +123,7 @@ static int mwifiex_unregister(struct mwifiex_adapter *adapter)
 	if (adapter->if_ops.cleanup_if)
 		adapter->if_ops.cleanup_if(adapter);
 
-	del_timer_sync(&adapter->cmd_timer);
+	timer_shutdown_sync(&adapter->cmd_timer);
 
 	/* Free private structures */
 	for (i = 0; i < adapter->priv_num; i++) {

index eb1d1ba3a443..b76b5ce95961 100644
@@ -1520,10 +1520,10 @@ int wilc_deinit(struct wilc_vif *vif)
 
 	mutex_lock(&vif->wilc->deinit_lock);
 
-	del_timer_sync(&hif_drv->scan_timer);
-	del_timer_sync(&hif_drv->connect_timer);
-	del_timer_sync(&vif->periodic_rssi);
-	del_timer_sync(&hif_drv->remain_on_ch_timer);
+	timer_shutdown_sync(&hif_drv->scan_timer);
+	timer_shutdown_sync(&hif_drv->connect_timer);
+	timer_shutdown_sync(&vif->periodic_rssi);
+	timer_shutdown_sync(&hif_drv->remain_on_ch_timer);
 
 	if (hif_drv->usr_scan_req.scan_result) {
 		hif_drv->usr_scan_req.scan_result(SCAN_EVENT_ABORTED, NULL,

index fc9eb02a912f..87b2ddfe86ac 100644
@@ -618,7 +618,7 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl
 
 	/* Delete timer and generate a final TRANSMIT_PDU event to flush out
 	 * all pending messages before the applicant is gone. */
-	del_timer_sync(&app->join_timer);
+	timer_shutdown_sync(&app->join_timer);
 
 	spin_lock_bh(&app->lock);
 	garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU);

index 155f74d8b14f..a744a28477dd 100644
@@ -904,7 +904,7 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl)
 	 * all pending messages before the applicant is gone.
 	 */
 	del_timer_sync(&app->join_timer);
-	del_timer_sync(&app->periodic_timer);
+	timer_shutdown_sync(&app->periodic_timer);
 
 	spin_lock_bh(&app->lock);
 	mrp_mad_event(app, MRP_EVENT_TX);

index db4f2641d1cd..16d2a7064e44 100644
@@ -605,7 +605,7 @@ static void br_multicast_destroy_mdb_entry(struct net_bridge_mcast_gc *gc)
 	WARN_ON(!hlist_unhashed(&mp->mdb_node));
 	WARN_ON(mp->ports);
 
-	del_timer_sync(&mp->timer);
+	timer_shutdown_sync(&mp->timer);
 	kfree_rcu(mp, rcu);
 }
 

@@ -646,7 +646,7 @@ static void br_multicast_destroy_group_src(struct net_bridge_mcast_gc *gc)
 	src = container_of(gc, struct net_bridge_group_src, mcast_gc);
 	WARN_ON(!hlist_unhashed(&src->node));
 
-	del_timer_sync(&src->timer);
+	timer_shutdown_sync(&src->timer);
 	kfree_rcu(src, rcu);
 }
 

@@ -671,7 +671,7 @@ static void br_multicast_destroy_port_group(struct net_bridge_mcast_gc *gc)
 	WARN_ON(!hlist_empty(&pg->src_list));
 
 	del_timer_sync(&pg->rexmit_timer);
-	del_timer_sync(&pg->timer);
+	timer_shutdown_sync(&pg->timer);
 	kfree_rcu(pg, rcu);
 }
 

index f91c071d1608..c126aa4e7551 100644
@@ -142,7 +142,7 @@ static void br_multicast_destroy_eht_set_entry(struct net_bridge_mcast_gc *gc)
 	set_h = container_of(gc, struct net_bridge_group_eht_set_entry, mcast_gc);
 	WARN_ON(!RB_EMPTY_NODE(&set_h->rb_node));
 
-	del_timer_sync(&set_h->timer);
+	timer_shutdown_sync(&set_h->timer);
 	kfree(set_h);
 }
 

@@ -154,7 +154,7 @@ static void br_multicast_destroy_eht_set(struct net_bridge_mcast_gc *gc)
 	WARN_ON(!RB_EMPTY_NODE(&eht_set->rb_node));
 	WARN_ON(!RB_EMPTY_ROOT(&eht_set->entry_tree));
 
-	del_timer_sync(&eht_set->timer);
+	timer_shutdown_sync(&eht_set->timer);
 	kfree(eht_set);
 }
 

index 4fcbdd71c59f..fae9c4694186 100644
@@ -208,7 +208,7 @@ void gen_kill_estimator(struct net_rate_estimator __rcu **rate_est)
 
 	est = xchg((__force struct net_rate_estimator **)rate_est, NULL);
 	if (est) {
-		del_timer_sync(&est->timer);
+		timer_shutdown_sync(&est->timer);
 		kfree_rcu(est, rcu);
 	}
 }

index 3c4786b99907..68edfd46781c 100644
@@ -895,6 +895,8 @@ void neigh_destroy(struct neighbour *neigh)
 	if (neigh_del_timer(neigh))
 		pr_warn("Impossible event\n");
 
+	timer_shutdown(&neigh->timer);
+
 	write_lock_bh(&neigh->lock);
 	__skb_queue_purge(&neigh->arp_queue);
 	write_unlock_bh(&neigh->lock);

index 4e84ed21d16f..5e70228c5ae9 100644
@@ -917,7 +917,7 @@ static bool reqsk_queue_unlink(struct request_sock *req)
 		found = __sk_nulls_del_node_init_rcu(sk);
 		spin_unlock(lock);
 	}
-	if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer))
+	if (timer_pending(&req->rsk_timer) && timer_shutdown_sync(&req->rsk_timer))
 		reqsk_put(req);
 	return found;
 }

index 66fc940f9521..8a70bb726bcb 100644
@@ -66,6 +66,7 @@ static void inet_twsk_kill(struct inet_timewait_sock *tw)
 void inet_twsk_free(struct inet_timewait_sock *tw)
 {
 	struct module *owner = tw->tw_prot->owner;
+	timer_shutdown(&tw->tw_timer);
 	twsk_destructor((struct sock *)tw);
 #ifdef SOCK_REFCNT_DEBUG
 	pr_debug("%s timewait_sock %p released\n", tw->tw_prot->name, tw);

@@ -208,7 +209,7 @@ EXPORT_SYMBOL_GPL(inet_twsk_alloc);
  */
 void inet_twsk_deschedule_put(struct inet_timewait_sock *tw)
 {
-	if (del_timer_sync(&tw->tw_timer))
+	if (timer_shutdown_sync(&tw->tw_timer))
 		inet_twsk_kill(tw);
 	inet_twsk_put(tw);
 }

index e04544ac4b45..dbaf4c33b155 100644
@@ -412,7 +412,7 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id)
 
 static void ipmr_free_table(struct mr_table *mrt)
 {
-	del_timer_sync(&mrt->ipmr_expire_timer);
+	timer_shutdown_sync(&mrt->ipmr_expire_timer);
 	mroute_clean_tables(mrt, MRT_FLUSH_VIFS | MRT_FLUSH_VIFS_STATIC |
 				 MRT_FLUSH_MFC | MRT_FLUSH_MFC_STATIC);
 	rhltable_destroy(&mrt->mfc_hash);

index facdc78a43e5..474b862039e0 100644
@@ -392,7 +392,7 @@ static struct mr_table *ip6mr_new_table(struct net *net, u32 id)
 
 static void ip6mr_free_table(struct mr_table *mrt)
 {
-	del_timer_sync(&mrt->ipmr_expire_timer);
+	timer_shutdown_sync(&mrt->ipmr_expire_timer);
 	mroute_clean_tables(mrt, MRT6_FLUSH_MIFS | MRT6_FLUSH_MIFS_STATIC |
 				 MRT6_FLUSH_MFC | MRT6_FLUSH_MFC_STATIC);
 	rhltable_destroy(&mrt->mfc_hash);

index acc1c299f1ae..ec72756075f5 100644
@@ -512,7 +512,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl,
 	mpath->flags |= MESH_PATH_RESOLVING | MESH_PATH_DELETED;
 	mesh_gate_del(tbl, mpath);
 	spin_unlock_bh(&mpath->state_lock);
-	del_timer_sync(&mpath->timer);
+	timer_shutdown_sync(&mpath->timer);
 	atomic_dec(&sdata->u.mesh.mpaths);
 	atomic_dec(&tbl->entries);
 	mesh_path_flush_pending(mpath);

index 5a67f7966574..e162636525cf 100644
@@ -427,7 +427,7 @@ list_set_destroy(struct ip_set *set)
 	struct set_elem *e, *n;
 
 	if (SET_WITH_TIMEOUT(set))
-		del_timer_sync(&map->gc);
+		timer_shutdown_sync(&map->gc);
 
 	list_for_each_entry_safe(e, n, &map->members, list) {
 		list_del(&e->list);

index 7ac7473e3804..1b87214d385e 100644
@@ -384,7 +384,7 @@ static void ip_vs_lblc_done_svc(struct ip_vs_service *svc)
 	struct ip_vs_lblc_table *tbl = svc->sched_data;
 
 	/* remove periodic timer */
-	del_timer_sync(&tbl->periodic_timer);
+	timer_shutdown_sync(&tbl->periodic_timer);
 
 	/* got to clean up table entries here */
 	ip_vs_lblc_flush(svc);

index 77c323c36a88..ad8f5fea6d3a 100644
@@ -547,7 +547,7 @@ static void ip_vs_lblcr_done_svc(struct ip_vs_service *svc)
 	struct ip_vs_lblcr_table *tbl = svc->sched_data;
 
 	/* remove periodic timer */
-	del_timer_sync(&tbl->periodic_timer);
+	timer_shutdown_sync(&tbl->periodic_timer);
 
 	/* got to clean up table entries here */
 	ip_vs_lblcr_flush(svc);

index 0371c387b0d1..66b0f941d8fb 100644
@@ -166,7 +166,7 @@ static void led_tg_destroy(const struct xt_tgdtor_param *par)
 
 	list_del(&ledinternal->list);
 
-	del_timer_sync(&ledinternal->timer);
+	timer_shutdown_sync(&ledinternal->timer);
 
 	led_trigger_unregister(&ledinternal->netfilter_led_trigger);
 

index 22089e37e97f..307d6d480e78 100644
@@ -358,7 +358,7 @@ static void rxrpc_destroy_connection(struct rcu_head *rcu)
 
 	_net("DESTROY CONN %d", conn->debug_id);
 
-	del_timer_sync(&conn->timer);
+	timer_shutdown_sync(&conn->timer);
 	rxrpc_purge_queue(&conn->rx_queue);
 
 	conn->security->clear(conn);

index 014cd3de7b5d..cd90a3083b9f 100644
@@ -367,7 +367,7 @@ static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = {
 
 static void __flow_destroy_filter(struct flow_filter *f)
 {
-	del_timer_sync(&f->perturb_timer);
+	timer_shutdown_sync(&f->perturb_timer);
 	tcf_exts_destroy(&f->exts);
 	tcf_em_tree_destroy(&f->ematches);
 	tcf_exts_put_net(&f->exts);

index 149171774bc6..42663e240ec5 100644
@@ -567,7 +567,7 @@ svc_destroy(struct kref *ref)
 	struct svc_serv *serv = container_of(ref, struct svc_serv, sv_refcnt);
 
 	dprintk("svc: svc_destroy(%s)\n", serv->sv_program->pg_name);
-	del_timer_sync(&serv->sv_temptimer);
+	timer_shutdown_sync(&serv->sv_temptimer);
 
 	/*
 	 * The last user is gone and thus all sockets have to be destroyed to

index ab453ede54f0..311718ce26d0 100644
@@ -2118,7 +2118,7 @@ static void xprt_destroy(struct rpc_xprt *xprt)
 	 * can only run *before* del_time_sync(), never after.
 	 */
 	spin_lock(&xprt->transport_lock);
-	del_timer_sync(&xprt->timer);
+	timer_shutdown_sync(&xprt->timer);
 	spin_unlock(&xprt->transport_lock);
 
 	/*

index e8630707901e..d9efbee90fb4 100644
@@ -385,7 +385,7 @@ int tipc_disc_create(struct net *net, struct tipc_bearer *b,
  */
 void tipc_disc_delete(struct tipc_discoverer *d)
 {
-	del_timer_sync(&d->timer);
+	timer_shutdown_sync(&d->timer);
 	kfree_skb(d->skb);
 	kfree(d);
 }

index 9618e4429f0f..77a3d016cade 100644
@@ -700,7 +700,7 @@ void tipc_mon_delete(struct net *net, int bearer_id)
 	}
 	mon->self = NULL;
 	write_unlock_bh(&mon->lock);
-	del_timer_sync(&mon->timer);
+	timer_shutdown_sync(&mon->timer);
 	kfree(self->domain);
 	kfree(self);
 	kfree(mon);

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/usb/gadget/udc/m66592-udc.c | 2 +-
 drivers/usb/serial/garmin_gps.c     | 2 +-
 drivers/usb/serial/mos7840.c        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

index 931e6362a13d..c7e421b449f3 100644
@@ -1519,7 +1519,7 @@ static int m66592_remove(struct platform_device *pdev)
 
 	usb_del_gadget_udc(&m66592->gadget);
 
-	del_timer_sync(&m66592->timer);
+	timer_shutdown_sync(&m66592->timer);
 	iounmap(m66592->reg);
 	free_irq(platform_get_irq(pdev, 0), m66592);
 	m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req);

index f1a8d8343623..670e942fdaaa 100644
@@ -1405,7 +1405,7 @@ static void garmin_port_remove(struct usb_serial_port *port)
 
 	usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
 	usb_kill_urb(port->interrupt_in_urb);
-	del_timer_sync(&garmin_data_p->timer);
+	timer_shutdown_sync(&garmin_data_p->timer);
 	kfree(garmin_data_p);
 }
 

index 6b12bb4648b8..8a2d902a1c12 100644
@@ -1726,7 +1726,7 @@ static void mos7840_port_remove(struct usb_serial_port *port)
 		mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300);
 
 		del_timer_sync(&mos7840_port->led_timer1);
-		del_timer_sync(&mos7840_port->led_timer2);
+		timer_shutdown_sync(&mos7840_port->led_timer2);
 
 		usb_kill_urb(mos7840_port->led_urb);
 		usb_free_urb(mos7840_port->led_urb);

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 kernel/cgroup/cgroup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 2319946715e0..e0c59a3b52e5 100644
@@ -1687,7 +1687,7 @@ static void cgroup_rm_file(struct cgroup *cgrp, const struct cftype *cft)
 		cfile->kn = NULL;
 		spin_unlock_irq(&cgroup_file_kn_lock);
 
-		del_timer_sync(&cfile->notify_timer);
+		timer_shutdown_sync(&cfile->notify_timer);
 	}
 
 	kernfs_remove_by_name(cgrp->kn, cgroup_file_name(cgrp, cft, name));

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 kernel/workqueue.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 7cd5f5e7e0a1..2bbea15be4c8 100644
@@ -3608,8 +3608,8 @@ static void put_unbound_pool(struct worker_pool *pool)
 		wait_for_completion(pool->detach_completion);
 
 	/* shut down the timers */
-	del_timer_sync(&pool->idle_timer);
-	del_timer_sync(&pool->mayday_timer);
+	timer_shutdown_sync(&pool->idle_timer);
+	timer_shutdown_sync(&pool->mayday_timer);
 
 	/* RCU protected to allow dereferences from get_work_pool() */
 	call_rcu(&pool->rcu, rcu_free_pool);

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/nfc/pn533/pn533.c | 2 +-
 drivers/nfc/pn533/uart.c  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

index d9f6367b9993..0a1d0b4e3bb8 100644
@@ -2788,7 +2788,7 @@ void pn53x_common_clean(struct pn533 *priv)
 	struct pn533_cmd *cmd, *n;
 
 	/* delete the timer before cleanup the worker */
-	del_timer_sync(&priv->listen_timer);
+	timer_shutdown_sync(&priv->listen_timer);
 
 	flush_delayed_work(&priv->poll_work);
 	destroy_workqueue(priv->wq);

index 07596bf5f7d6..a556acdb947b 100644
@@ -310,7 +310,7 @@ static void pn532_uart_remove(struct serdev_device *serdev)
 	pn53x_unregister_nfc(pn532->priv);
 	serdev_device_close(serdev);
 	pn53x_common_clean(pn532->priv);
-	del_timer_sync(&pn532->cmd_timeout);
+	timer_shutdown_sync(&pn532->cmd_timeout);
 	kfree_skb(pn532->recv_skb);
 	kfree(pn532);
 }

2.35.1

I think link has to be updated.

Best regards,
Krzysztof

Yes, I was lazy on that. My next patch series will point to 00 of this series.

Thanks,

-- Steve

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/pcmcia/bcm63xx_pcmcia.c | 2 +-
 drivers/pcmcia/electra_cf.c     | 2 +-
 drivers/pcmcia/omap_cf.c        | 2 +-
 drivers/pcmcia/pd6729.c         | 4 ++--
 drivers/pcmcia/yenta_socket.c   | 4 ++--
 5 files changed, 7 insertions(+), 7 deletions(-)

index bb06311d0b5f..dd3c26099048 100644
@@ -443,7 +443,7 @@ static int bcm63xx_drv_pcmcia_remove(struct platform_device *pdev)
 	struct resource *res;
 
 	skt = platform_get_drvdata(pdev);
-	del_timer_sync(&skt->timer);
+	timer_shutdown_sync(&skt->timer);
 	iounmap(skt->base);
 	iounmap(skt->io_base);
 	res = skt->reg_res;

index 40a5cffe24a4..efc27bc15152 100644
@@ -317,7 +317,7 @@ static int electra_cf_remove(struct platform_device *ofdev)
 	cf->active = 0;
 	pcmcia_unregister_socket(&cf->socket);
 	free_irq(cf->irq, cf);
-	del_timer_sync(&cf->timer);
+	timer_shutdown_sync(&cf->timer);
 
 	iounmap(cf->io_virt);
 	iounmap(cf->mem_base);

index d3f827d4224a..e613818dc0bc 100644
@@ -296,7 +296,7 @@ static int __exit omap_cf_remove(struct platform_device *pdev)
 
 	cf->active = 0;
 	pcmcia_unregister_socket(&cf->socket);
-	del_timer_sync(&cf->timer);
+	timer_shutdown_sync(&cf->timer);
 	release_mem_region(cf->phys_cf, SZ_8K);
 	free_irq(cf->irq, cf);
 	kfree(cf);

index f0af9985ca09..a0a2e7f18356 100644
@@ -727,7 +727,7 @@ static int pd6729_pci_probe(struct pci_dev *dev,
 	if (irq_mode == 1)
 		free_irq(dev->irq, socket);
 	else
-		del_timer_sync(&socket->poll_timer);
+		timer_shutdown_sync(&socket->poll_timer);
 err_out_free_res:
 	pci_release_regions(dev);
 err_out_disable:

@@ -754,7 +754,7 @@ static void pd6729_pci_remove(struct pci_dev *dev)
 	if (irq_mode == 1)
 		free_irq(dev->irq, socket);
 	else
-		del_timer_sync(&socket->poll_timer);
+		timer_shutdown_sync(&socket->poll_timer);
 	pci_release_regions(dev);
 	pci_disable_device(dev);
 

index 3966a6ceb1ac..1365eaa20ff4 100644
@@ -814,7 +814,7 @@ static void yenta_close(struct pci_dev *dev)
 	if (sock->cb_irq)
 		free_irq(sock->cb_irq, sock);
 	else
-		del_timer_sync(&sock->poll_timer);
+		timer_shutdown_sync(&sock->poll_timer);
 
 	iounmap(sock->base);
 	yenta_free_resources(sock);

@@ -1285,7 +1285,7 @@ static int yenta_probe(struct pci_dev *dev, const struct pci_device_id *id)
 	if (socket->cb_irq)
 		free_irq(socket->cb_irq, socket);
 	else
-		del_timer_sync(&socket->poll_timer);
+		timer_shutdown_sync(&socket->poll_timer);
  unmap:
 	iounmap(socket->base);
 	yenta_free_resources(socket);

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called, or timer_shutdown() if it's already known that the timer is disabled.

---
 drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
 drivers/scsi/scsi_lib.c         | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

index 00ccc41cef14..7f3a3c8673b5 100644
@@ -416,7 +416,7 @@ static void __qla2x00_release_all_sadb(struct scsi_qla_host *vha,
 				 */
 				if (edif_entry->delete_sa_index !=
 						INVALID_EDIF_SA_INDEX) {
-					del_timer(&edif_entry->timer);
+					timer_shutdown_sync(&edif_entry->timer);
 
 					/* build and send the aen */
 					fcport->edif.rx_sa_set = 1;

@@ -2799,7 +2799,7 @@ qla28xx_sa_update_iocb_entry(scsi_qla_host_t *v, struct req_que *req,
 			    "%s: removing edif_entry %p, new sa_index: 0x%x\n",
 			    __func__, edif_entry, pkt->sa_index);
 			qla_edif_list_delete_sa_index(sp->fcport, edif_entry);
-			del_timer(&edif_entry->timer);
+			timer_shutdown_sync(&edif_entry->timer);
 
 			ql_dbg(ql_dbg_edif, vha, 0x5033,
 			    "%s: releasing edif_entry %p, new sa_index: 0x%x\n",

index 8b89fab7c420..e6cd1efb9eca 100644
@@ -558,6 +558,7 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
 	 */
 	destroy_rcu_head(&cmd->rcu);
 
+	timer_shutdown(&cmd->abort_work.timer);
 	/*
 	 * In the MQ case the command gets freed by __blk_mq_end_request,
 	 * so we have to do all cleanup that depends on it earlier.

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 drivers/tty/n_gsm.c | 2 +-
 drivers/tty/sysrq.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

index 5e516f5cac5a..6f48adecd1d4 100644
@@ -2098,7 +2098,7 @@ static void gsm_dlci_free(struct tty_port *port)
 {
 	struct gsm_dlci *dlci = container_of(port, struct gsm_dlci, port);
 
-	del_timer_sync(&dlci->t1);
+	timer_shutdown_sync(&dlci->t1);
 	dlci->gsm->dlci[dlci->addr] = NULL;
 	kfifo_free(&dlci->fifo);
 	while ((dlci->skb = skb_dequeue(&dlci->skb_list)))

index d2b2720db6ca..b6e70c5cfa17 100644
@@ -1003,7 +1003,7 @@ static void sysrq_disconnect(struct input_handle *handle)
 
 	input_close_device(handle);
 	cancel_work_sync(&sysrq->reinject_work);
-	del_timer_sync(&sysrq->keyreset_timer);
+	timer_shutdown_sync(&sysrq->keyreset_timer);
 	input_unregister_handle(handle);
 	kfree(sysrq);
 }

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 fs/ext4/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 7950904fbf04..f54ed936d800 100644
@@ -1225,7 +1225,7 @@ static void ext4_put_super(struct super_block *sb)
 	}
 
 	ext4_es_unregister_shrinker(sbi);
-	del_timer_sync(&sbi->s_err_report);
+	timer_shutdown_sync(&sbi->s_err_report);
 	ext4_release_system_zone(sb);
 	ext4_mb_release(sb);
 	ext4_ext_release(sb);

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 fs/nilfs2/segment.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index b4cebad21b48..c50dc377da26 100644
@@ -2752,7 +2752,7 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)
 
 	down_write(&nilfs->ns_segctor_sem);
 
-	del_timer_sync(&sci->sc_timer);
+	timer_shutdown_sync(&sci->sc_timer);
 	kfree(sci);
 }
 

2.35.1

This is the second time, but my Ack is not tagged, so I'll reply again just in case.

Thanks,
Ryusuke Konishi

Thanks. I might have missed it, but I also changed the name, and wanted to make sure everyone saw that ;-)

-- Steve

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 sound/i2c/other/ak4117.c | 2 +-
 sound/synth/emux/emux.c  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

index 1bc43e927d82..640501bb3ca6 100644
@@ -47,7 +47,7 @@ static void reg_dump(struct ak4117 *ak4117)
 
 static void snd_ak4117_free(struct ak4117 *chip)
 {
-	del_timer_sync(&chip->timer);
+	timer_shutdown_sync(&chip->timer);
 	kfree(chip);
 }
 

index a870759d179e..0006c3ddb51d 100644
@@ -129,7 +129,7 @@ int snd_emux_free(struct snd_emux *emu)
 	if (! emu)
 		return -EINVAL;
 
-	del_timer_sync(&emu->tlist);
+	timer_shutdown_sync(&emu->tlist);
 
 	snd_emux_proc_free(emu);
 	snd_emux_delete_virmidi(emu);

2.35.1

thanks,

Takashi

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown() must be called. Note that it is assumed that the timer is not running while being freed, so only timer_shutdown() is used, and not timer_shutdown_sync().

---
 fs/jbd2/journal.c | 2 ++
 1 file changed, 2 insertions(+)

index 2696f43e7239..57d2445d8c8b 100644
@@ -2157,6 +2157,8 @@ int jbd2_journal_destroy(journal_t *journal)
 	J_ASSERT(journal->j_checkpoint_transactions == NULL);
 	spin_unlock(&journal->j_list_lock);
 
+	timer_shutdown(&journal->j_commit_timer);
+
 	/*
 	 * OK, all checkpoint transactions have been checked, now check the
 	 * write out io error flag and abort the journal if some buffer failed

2.35.1

Looks good to me. Feel free to add:

Honza

Jan Kara <[email protected]>
SUSE Labs, CR

From: "Steven Rostedt (Google)" <[email protected]>

Before a timer is freed, timer_shutdown_sync() must be called.

---
 kernel/sched/psi.c | 1 +
 1 file changed, 1 insertion(+)

index ee2ecc081422..f5f2613c4292 100644
@@ -1033,6 +1033,7 @@ void psi_cgroup_free(struct cgroup *cgroup)
 
 	cancel_delayed_work_sync(&cgroup->psi->avgs_work);
 	free_percpu(cgroup->psi->pcpu);
+	timer_shutdown_sync(&cgroup->psi->poll_timer);
 	/* All triggers must be removed by now */
 	WARN_ONCE(cgroup->psi->poll_states, "psi: trigger leak\n");
 	kfree(cgroup->psi);

2.35.1

Assuming the whole patchset makes it through the reviews, this part LGTM.

From: "Steven Rostedt (Google)" <[email protected]>

DEBUG_OBJECTS_TIMERS is now checking if a timer is ever enqueued, and if so, it must call timer_shutdown_sync() before freeing, otherwise debug objects will trigger. This requires that once a timer is initialized (and initialized for debug objects) it must not be re-initialized using timer_setup(), as that will call the debug objects initialization code again and trigger a bug if it was ever used.

As the mce reinitializes its timers on CPU hotplug, it must use __init_timer() instead of timer_setup(), which will only initialize the debug objects once.

---
 arch/x86/kernel/cpu/mce/core.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

index 2c8ec5c71712..d2653c7d40b3 100644
@@ -2051,14 +2051,24 @@ static void __mcheck_cpu_setup_timer(void)
 {
 	struct timer_list *t = this_cpu_ptr(&mce_timer);
 
-	timer_setup(t, mce_timer_fn, TIMER_PINNED);
+	/*
+	 * timer_setup() may only be used on a timer for the
+	 * first time it is initialized. This resets the
+	 * timer on CPU hotplug, so use __init_timer() instead.
+	 */
+	__init_timer(t, mce_timer_fn, TIMER_PINNED);
 }
 
 static void __mcheck_cpu_init_timer(void)
 {
 	struct timer_list *t = this_cpu_ptr(&mce_timer);
 
-	timer_setup(t, mce_timer_fn, TIMER_PINNED);
+	/*
+	 * timer_setup() may only be used on a timer for the
+	 * first time it is initialized. This resets the
+	 * timer on CPU hotplug, so use __init_timer() instead.
+	 */
+	__init_timer(t, mce_timer_fn, TIMER_PINNED);
 	mce_start_timer(t);
 }
 

2.35.1

From: "Steven Rostedt (Google)" <[email protected]>

There's been too many bugs happening where a timer is removed, either by del_timer() or even del_timer_sync() but get's re-armed again by a workqueue or some other task. Then the timer is freed while it's still queued to go off. When the timer eventually goes off, as its content no longer exists, it causes a crash in the timer code.

This is very hard to debug because all evidence of who added the timer is gone.

Currently, DEBUG_OBJECTS_TIMER will trigger if this happens, but as this only happens rarely (but in the field, thousands of times) and may depend on performing various tasks (USB unplug, CPU hotplug, suspend and resume), not to mention that enabling DEBUG_OBJECTS_TIMER has too much overhead to run in the field, it seldom catches these types of bugs.

Now that timer_shutdown_sync() is to be called before freeing, move the checks of DEBUG_OBJECTS_TIMER to if it ever gets armed to where timer_shutdown_sync() is called. If there's a case where a timer is armed, and then freed without calling timer_shutdown_sync() DEBUG_OBJECTS_TIMER will now trigger on it.

This catches cases that are potential issues instead of just catching when the race condition occurs.

Note, due to delayed workqueues that use timers but they themselves do not supply a shutdown method, there's no way to be able to call timer_shutdown() on delayed work timers correctly. Because of this, the delayed work timers will add a state to inform the DEBUG_OBJECTS_TIMER code that its a timer for a delayed work. The delayed work timers will be treated the old way of only trigging an issue if its timer is active when freed, but does not need to be shutdown first.

Work may be needed to make workqueue code also have a shutdown state.

---
 include/linux/timer.h     | 36 +++++++++++++++++++++++++++++-
 include/linux/workqueue.h |  4 ++--
 kernel/time/timer.c       | 46 +++++++++++++++++++++++++++++++++------
 3 files changed, 76 insertions(+), 10 deletions(-)

index 0758b447afd7..ab6148db289e 100644
@@ -8,6 +8,12 @@
 #include <linux/debugobjects.h>
 #include <linux/stringify.h>
 
+enum timer_debug_state {
+	TIMER_DEBUG_DISABLED,
+	TIMER_DEBUG_ENABLED,
+	TIMER_DEBUG_WORK,
+};
+
 struct timer_list {
 	/*
 	 * All fields that change during normal runtime grouped to the

@@ -18,6 +24,9 @@ struct timer_list {
 	void			(*function)(struct timer_list *);
 	u32			flags;
 
+#ifdef CONFIG_DEBUG_OBJECTS_TIMERS
+	enum timer_debug_state	enabled;
+#endif
 #ifdef CONFIG_LOCKDEP
 	struct lockdep_map	lockdep_map;
 #endif

@@ -128,6 +137,31 @@ static inline void init_timer_on_stack_key(struct timer_list *timer,
 	init_timer_on_stack_key((_timer), (_fn), (_flags), NULL, NULL)
 #endif
 
+#ifdef CONFIG_DEBUG_OBJECTS_TIMERS
+#define __init_timer_debug(_timer, _fn, _flags)				\
+	do {								\
+		(_timer)->enabled = TIMER_DEBUG_DISABLED;		\
+		__init_timer((_timer), (_fn), (_flags));		\
+	} while (0)
+#define __init_timer_work(_timer, _fn, _flags)				\
+	do {								\
+		(_timer)->enabled = TIMER_DEBUG_WORK;			\
+		__init_timer((_timer), (_fn), (_flags));		\
+	} while (0)
+#define __init_timer_work_on_stack(_timer, _fn, _flags)				\
+	do {								\
+		(_timer)->enabled = TIMER_DEBUG_WORK;			\
+		__init_timer_on_stack((_timer), (_fn), (_flags));	\
+	} while (0)
+#else
+#define __init_timer_debug(_timer, _fn, _flags)				\
+	__init_timer((_timer), (_fn), (_flags))
+#define __init_timer_work(_timer, _fn, _flags)				\
+	__init_timer((_timer), (_fn), (_flags))
+#define __init_timer_work_on_stack(_timer, _fn, _flags)			\
+	__init_timer_on_stack((_timer), (_fn), (_flags))
+#endif
+
 /**
  * timer_setup - prepare a timer for first use
  * @timer: the timer in question

@@ -139,7 +173,7 @@ static inline void init_timer_on_stack_key(struct timer_list *timer,
  * be used and must be balanced with a call to destroy_timer_on_stack().
  */
 #define timer_setup(timer, callback, flags)			\
-	__init_timer((timer), (callback), (flags))
+	__init_timer_debug((timer), (callback), (flags))
 
 #define timer_setup_on_stack(timer, callback, flags)		\
 	__init_timer_on_stack((timer), (callback), (flags))

index a0143dd24430..290c96429ce1 100644
@@ -250,7 +250,7 @@ static inline unsigned int work_static(struct work_struct *work) { return 0; }
 #define __INIT_DELAYED_WORK(_work, _func, _tflags)			\
 	do {								\
 		INIT_WORK(&(_work)->work, (_func));			\
-		__init_timer(&(_work)->timer,				\
+		__init_timer_work(&(_work)->timer,			\
 			     delayed_work_timer_fn,			\
 			     (_tflags) | TIMER_IRQSAFE);		\
 	} while (0)

@@ -258,7 +258,7 @@ static inline unsigned int work_static(struct work_struct *work) { return 0; }
 #define __INIT_DELAYED_WORK_ONSTACK(_work, _func, _tflags)		\
 	do {								\
 		INIT_WORK_ONSTACK(&(_work)->work, (_func));		\
-		__init_timer_on_stack(&(_work)->timer,			\
+		__init_timer_work_on_stack(&(_work)->timer,		\
 				      delayed_work_timer_fn,		\
 				      (_tflags) | TIMER_IRQSAFE);	\
 	} while (0)

2.35.1

Ack.

I also wonder if we could do the completely trivially correct conversions immediately.

I'm talking about the scripted ones where it's currently a "del_timer_sync()", and the very next action is freeing whatever data structure the timer is in (possibly with something like free_irq() in between - my point is that there's an unconditional free that is very clear and unambiguous), so that there is absolutely no question about whether they should use "timer_shutdown_sync()" or not.

IOW, things like patches 03, 17 and 31, and at least parts others in this series.

This series clearly has several much more complex cases that need actual real code review, and I think it would help to have the completely unambiguous cases out of the way, just to get rid of noise.

So I'd take that first patch, and a scripted set of "this cannot change any semantics" patches early.

Linus

Unfortunately the renaming caused some symbol conflicts.

Global definition: timer_shutdown

File Line
0 time.c 93 static inline void timer_shutdown(struct clock_event_device *evt)
1 arm_arch_timer.c 690 static __always_inline int timer_shutdown(const int access, 2 timer-fttmr010.c 105 int (*timer_shutdown)(struct clock_event_device *evt);
3 timer-sp804.c 158 static inline void timer_shutdown(struct clock_event_device *evt)
4 timer.h 239 static inline int timer_shutdown(struct timer_list *timer)

Guenter

$ git grep '\btimer_shutdown'
arch/arm/mach-spear/time.c:static inline void timer_shutdown(struct clock_event_device *evt)
arch/arm/mach-spear/time.c:     timer_shutdown(evt);
arch/arm/mach-spear/time.c:     timer_shutdown(evt);
arch/arm/mach-spear/time.c:     timer_shutdown(evt);
drivers/clocksource/arm_arch_timer.c:static __always_inline int timer_shutdown(const int access,
drivers/clocksource/arm_arch_timer.c:   return timer_shutdown(ARCH_TIMER_VIRT_ACCESS, clk);
drivers/clocksource/arm_arch_timer.c:   return timer_shutdown(ARCH_TIMER_PHYS_ACCESS, clk);
drivers/clocksource/arm_arch_timer.c:   return timer_shutdown(ARCH_TIMER_MEM_VIRT_ACCESS, clk);
drivers/clocksource/arm_arch_timer.c:   return timer_shutdown(ARCH_TIMER_MEM_PHYS_ACCESS, clk);
drivers/clocksource/timer-fttmr010.c:   int (*timer_shutdown)(struct clock_event_device *evt);
drivers/clocksource/timer-fttmr010.c:   fttmr010->timer_shutdown(evt);
drivers/clocksource/timer-fttmr010.c:   fttmr010->timer_shutdown(evt);
drivers/clocksource/timer-fttmr010.c:   fttmr010->timer_shutdown(evt);
drivers/clocksource/timer-fttmr010.c:           fttmr010->timer_shutdown = ast2600_timer_shutdown;
drivers/clocksource/timer-fttmr010.c:           fttmr010->timer_shutdown = fttmr010_timer_shutdown;
drivers/clocksource/timer-fttmr010.c:   fttmr010->clkevt.set_state_shutdown = fttmr010->timer_shutdown;
drivers/clocksource/timer-fttmr010.c:   fttmr010->clkevt.tick_resume = fttmr010->timer_shutdown;
drivers/clocksource/timer-sp804.c:static inline void timer_shutdown(struct clock_event_device *evt)
drivers/clocksource/timer-sp804.c:      timer_shutdown(evt);
drivers/clocksource/timer-sp804.c:      timer_shutdown(evt);

Honestly, I think these need to be renamed, as "timer_shutdown()" should be specific to the timer code, and not individual timers.

I'll start making a patch set that starts by renaming these timers, then adds the timer_shutdown() API, and finished with the trivial updates, and that will be a real "PATCH" (non RFC).

Linus, should I also add any patches that has already been acked by the respective maintainer?

-- Steve

No, I'd prefer to keep only the ones that are 100% unambiguously not changing any semantics.

Linus

I won't touch structure fields though.

-- Steve

[ ... ]

Agreed, same here.

Guenter