Commit 292a089d authored by Steven Rostedt (Google)'s avatar Steven Rostedt (Google) Committed by Linus Torvalds
Browse files

treewide: Convert del_timer*() to timer_shutdown*() 

Due to several bugs caused by timers being re-armed after they are
shutdown and just before they are freed, a new state of timers was added
called "shutdown".  After a timer is set to this state, then it can no
longer be re-armed.

The following script was run to find all the trivial locations where
del_timer() or del_timer_sync() is called in the same function that the
object holding the timer is freed.  It also ignores any locations where
the timer->function is modified between the del_timer*() and the free(),
as that is not considered a "trivial" case.

This was created by using a coccinelle script and the following
commands:

    $ cat timer.cocci
    @@
    expression ptr, slab;
    identifier timer, rfield;
    @@
    (
    -       del_timer(&ptr->timer);
    +       timer_shutdown(&ptr->timer);
    |
    -       del_timer_sync(&ptr->timer);
    +       timer_shutdown_sync(&ptr->timer);
    )
      ... when strict
          when != ptr->timer
    (
            kfree_rcu(ptr, rfield);
    |
            kmem_cache_free(slab, ptr);
    |
            kfree(ptr);
    )

    $ spatch timer.cocci . > /tmp/t.patch
    $ patch -p1 < /tmp/t.patch

Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/


Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: Pavel Machek <pavel@ucw.cz> [ LED ]
Acked-by: Kalle Valo <kvalo@kernel.org> [ wireless ]
Acked-by: Paolo Abeni <pabeni@redhat.com> [ networking ]
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 72a85e2b

arch/sh/drivers/push-switch.c

+1 −1
Original line number Diff line number Diff line
@@ -102,7 +102,7 @@ static int switch_drv_remove(struct platform_device *pdev) 


	platform_set_drvdata(pdev, NULL);

	flush_work(&psw->work);

	del_timer_sync(&psw->debounce);

	timer_shutdown_sync(&psw->debounce);

	free_irq(irq, pdev);



	kfree(psw);

block/blk-iocost.c

+1 −1
Original line number Diff line number Diff line
@@ -2820,7 +2820,7 @@ static void ioc_rqos_exit(struct rq_qos *rqos) 
	ioc->running = IOC_STOP;

	spin_unlock_irq(&ioc->lock);



	del_timer_sync(&ioc->timer);

	timer_shutdown_sync(&ioc->timer);

	free_percpu(ioc->pcpu_stat);

	kfree(ioc);

}

block/blk-iolatency.c

+1 −1
Original line number Diff line number Diff line
@@ -644,7 +644,7 @@ static void blkcg_iolatency_exit(struct rq_qos *rqos) 
{

	struct blk_iolatency *blkiolat = BLKIOLATENCY(rqos);



	del_timer_sync(&blkiolat->timer);

	timer_shutdown_sync(&blkiolat->timer);

	flush_work(&blkiolat->enable_work);

	blkcg_deactivate_policy(rqos->q, &blkcg_policy_iolatency);

	kfree(blkiolat);

block/kyber-iosched.c

+1 −1
Original line number Diff line number Diff line
@@ -434,7 +434,7 @@ static void kyber_exit_sched(struct elevator_queue *e) 
	struct kyber_queue_data *kqd = e->elevator_data;

	int i;



	del_timer_sync(&kqd->timer);

	timer_shutdown_sync(&kqd->timer);

	blk_stat_disable_accounting(kqd->q);



	for (i = 0; i < KYBER_NUM_DOMAINS; i++)

drivers/acpi/apei/ghes.c

+1 −1
Original line number Diff line number Diff line
@@ -1431,7 +1431,7 @@ static int ghes_remove(struct platform_device *ghes_dev) 
	ghes->flags |= GHES_EXITING;

	switch (generic->notify.type) {

	case ACPI_HEST_NOTIFY_POLLED:

		del_timer_sync(&ghes->timer);

		timer_shutdown_sync(&ghes->timer);

		break;

	case ACPI_HEST_NOTIFY_EXTERNAL:

		free_irq(ghes->irq, ghes);