Patch "timers: Plug locking race vs. timer migration" has been added to the 4.8-stable tree

This is a note to let you know that I've just added the patch titled

timers: Plug locking race vs. timer migration

to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
timers-plug-locking-race-vs.-timer-migration.patch
and it can be found in the queue-4.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Thomas Gleixner <[email protected]>
Date: Mon, 24 Oct 2016 11:41:56 +0200
Subject: timers: Plug locking race vs. timer migration

From: Thomas Gleixner <[email protected]>

commit b831275a3553c32091222ac619cfddd73a5553fb upstream.

Linus noticed that lock_timer_base() lacks a READ_ONCE() for accessing the timer flags. As a consequence the compiler is allowed to reload the flags between the initial check for TIMER_MIGRATION and the following timer base computation and the spin lock of the base.

While this has not been observed (yet), we need to make sure that it never happens.

---
 kernel/time/timer.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

@@ -937,7 +937,14 @@ static struct timer_base *lock_timer_bas
 {
 	for (;;) {
 		struct timer_base *base;
-		u32 tf = timer->flags;
+		u32 tf;
+
+		/*
+		 * We need to use READ_ONCE() here, otherwise the compiler
+		 * might re-read @tf between the check for TIMER_MIGRATING
+		 * and spin_lock().
+		 */
+		tf = READ_ONCE(timer->flags);
 
 		if (!(tf & TIMER_MIGRATING)) {
 			base = get_timer_base(tf);

Patches currently in stable-queue which might be from [email protected] are

queue-4.8/x86-microcode-amd-fix-more-fallout-from-config_randomize_memory-y.patch queue-4.8/timers-lock-base-for-same-bucket-optimization.patch queue-4.8/timers-plug-locking-race-vs.-timer-migration.patch queue-4.8/timers-prevent-base-clock-corruption-when-forwarding.patch queue-4.8/timers-prevent-base-clock-rewind-when-forwarding-clock.patch