Skip to content

timers: Plug debugobject leaks and use del_timer_sync() in exit/teardown

Thomas Gleixner cpufreq linux-bluetooth linux-input linux-pm linux-s390 linux-scsi lkml netdev 1 version Applied

Status from this message: Applied, thank you Thomas.

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest16 patches 22 repliesApplied

Patches in v1 Applied

#Subject and filesSizeRepliesApplied
1/16s390: tape: Use del_timer_sync()drivers/s390/char/tape_std.c+1 -11 reply
2/16s390: tape: Add missing destroy_timer_on_stack()drivers/s390/char/tape_std.c+1 -01 reply
3/16s390: net: lcs: Add missing destroy_timer_on_stack()drivers/s390/net/lcs.c+1 -01 reply
4/16scsi: qla1280: Add missing destroy_timer_on_stack()drivers/scsi/qla1280.c+1 -00 replies
5/16thermal: powerclamp: Add missing destroy_timer_on_stack()drivers/thermal/intel_powerclamp.c+1 -00 replies
6/16rcu: torture: Add missing destroy_timer_on_stack()kernel/rcu/torture.c+3 -12 replies
7/16atm: firestream: Use del_timer_sync() in teardown pathdrivers/atm/firestream.c+1 -11 reply
8/16atm: idt77105: Use del_timer_sync() in exit pathdrivers/atm/idt77105.c+3 -31 reply
9/16block: cpqarray: Use del_timer_sync() in teardowndrivers/block/cpqarray.c+1 -10 replies
10/16block: umem: Use del_timer_sync() in exit pathdrivers/block/umem.c+1 -10 replies
11/16block: xsysace; Use del_timer_sync() in exit pathdrivers/block/xsysace.c+2 -00 replies
12/16bt: bluecard: Use del_timer_sync() in teardown pathdrivers/bluetooth/bluecard_cs.c+1 -11 reply
13/16bt: hci-bcsp: Use del_timer_sync() in teardown pathdrivers/bluetooth/hci_bcsp.c+1 -11 reply
14/16bt: hci-h5: Use del_timer_sync() in exit pathdrivers/bluetooth/hci_h5.c+1 -11 reply
15/16cpufreq: intel-pstate: Use del_timer_sync in intel_pstate_cpu_exit()drivers/cpufreq/intel_pstate.c+1 -13 replies
16/16input: serio: hp_sdc: Use del_timer_sync() in exit pathdrivers/input/serio/hp_sdc.c+1 -11 reply

Reviews trailers per patch

2 of 16 patches have a Reviewed-by or Acked-by.

PatchJosh TriplettViresh Kumar
1/16
2/16
3/16
4/16
5/16
6/16R-b
7/16
8/16
9/16
10/16
11/16
12/16
13/16
14/16
15/16A-b
16/16

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v1 thread

Cover letter [patch 00/16] timers: Plug debugobject leaks and use del_timer_sync() in exit/teardown

Timers on stack must be initialized with init_timer_on_stack() which creates a tracking object if DEBUG_OBJECTS is enabled. Quite some places miss the complementary destroy_timer_on_stack(), which frees the tracking object. So we leak the tracking object in the debug objects store.

While looking at that, one affected driver also used del_timer() instead of del_timer_sync() before returning, which is wrong as well as del_timer() meriliy dequeues an armed timer, but does not wait for a callback which is executed on a different cpu.

So I started to look through del_timer() sites and fixed a bunch of obvious teardown, module exit pathes which must use del_timer_sync().

As I'm about to travel, I gave up on reviewing all the usage sites of del_timer().

Maybe Julia has an idea to automate the scan a bit. The paring for init_timer_on_stack/destroy_timer_on_stack should be easy enough, but the del_timer() one is pretty complex and definitly needs manual auditing, but having a scan assistant to identify potential places would be definitely helpful.

Thanks,

tglx

---
 drivers/atm/firestream.c           |    2 +-
 drivers/atm/idt77105.c             |    6 +++---
 drivers/block/cpqarray.c           |    2 +-
 drivers/block/umem.c               |    2 +-
 drivers/block/xsysace.c            |    2 ++
 drivers/bluetooth/bluecard_cs.c    |    2 +-
 drivers/bluetooth/hci_bcsp.c       |    2 +-
 drivers/bluetooth/hci_h5.c         |    2 +-
 drivers/cpufreq/intel_pstate.c     |    2 +-
 drivers/input/serio/hp_sdc.c       |    2 +-
 drivers/s390/char/tape_std.c       |    3 ++-
 drivers/s390/net/lcs.c             |    1 +
 drivers/scsi/qla1280.c             |    1 +
 drivers/thermal/intel_powerclamp.c |    1 +
 kernel/rcu/torture.c               |    4 +++-
 15 files changed, 21 insertions(+), 13 deletions(-)