Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'timers-urgent-2026-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fix from Ingo Molnar:
"Fix CPU hotplug activation race in the timer migration code, by
Frederic Weisbecker"
* tag 'timers-urgent-2026-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
timers/migration: Fix another hotplug activation race
+29
-11
+29
-11
kernel/time/timer_migration.c
+29
-11
kernel/time/timer_migration.c
···
1860
1860
* child to the new parents. So tmigr_active_up() activates the
1861
1861
* new parents while walking up from the old root to the new.
1862
1862
*
1863
-
* * It is ensured that @start is active, as this setup path is
1864
-
* executed in hotplug prepare callback. This is executed by an
1865
-
* already connected and !idle CPU. Even if all other CPUs go idle,
1866
-
* the CPU executing the setup will be responsible up to current top
1867
-
* level group. And the next time it goes inactive, it will release
1868
-
* the new childmask and parent to subsequent walkers through this
1869
-
* @child. Therefore propagate active state unconditionally.
1863
+
* * It is ensured that @start is active, (or on the way to be activated
1864
+
* by another CPU that woke up before the current one) as this setup path
1865
+
* is executed in hotplug prepare callback. This is executed by an already
1866
+
* connected and !idle CPU in the hierarchy.
1867
+
*
1868
+
* * The below RmW atomic operation ensures that:
1869
+
*
1870
+
* 1) If the old root has been completely activated, the latest state is
1871
+
* acquired (the below implicit acquire pairs with the implicit release
1872
+
* from cmpxchg() in tmigr_active_up()).
1873
+
*
1874
+
* 2) If the old root is still on the way to be activated, the lagging behind
1875
+
* CPU performing the activation will acquire the links up to the new root.
1876
+
* (The below implicit release pairs with the implicit acquire from cmpxchg()
1877
+
* in tmigr_active_up()).
1878
+
*
1879
+
* 3) Every subsequent CPU below the old root will acquire the new links while
1880
+
* walking through the old root (The below implicit release pairs with the
1881
+
* implicit acquire from cmpxchg() in either tmigr_active_up()) or
1882
+
* tmigr_inactive_up().
1870
1883
*/
1871
-
state.state = atomic_read(&start->migr_state);
1872
-
WARN_ON_ONCE(!state.active);
1884
+
state.state = atomic_fetch_or(0, &start->migr_state);
1873
1885
WARN_ON_ONCE(!start->parent);
1874
-
data.childmask = start->groupmask;
1875
-
__walk_groups_from(tmigr_active_up, &data, start, start->parent);
1886
+
/*
1887
+
* If the state of the old root is inactive, another CPU is on its way to activate
1888
+
* it and propagate to the new root.
1889
+
*/
1890
+
if (state.active) {
1891
+
data.childmask = start->groupmask;
1892
+
__walk_groups_from(tmigr_active_up, &data, start, start->parent);
1893
+
}
1876
1894
}
1877
1895
1878
1896
/* Root update */