posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del()

If posix_cpu_timer_del() exits early due to task not found or sighand
invalid, it fails to clear the state of the timer. That's harmless but
inconsistent.

These early exits are accounted as successful delete. Move the update of
the timer state into the success return path, so all "successful" deletions
are handled.

Reported-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Link: https://lore.kernel.org/all/20241105064212.974053438@linutronix.de

diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 12f828d704b1b8ee843b64de0ff1c9e2ca3ffa71..5f444e3724649b11a9bd86130f250412df4cd7c5 100644 (file)
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -493,20 +493,20 @@ static int posix_cpu_timer_del(struct k_itimer *timer)
                 */
                WARN_ON_ONCE(ctmr->head || timerqueue_node_queued(&ctmr->node));
        } else {
-               if (timer->it.cpu.firing) {
+               if (timer->it.cpu.firing)
                        ret = TIMER_RETRY;
-               } else {
+               else
                        disarm_timer(timer, p);
-                       timer->it_status = POSIX_TIMER_DISARMED;
-               }
                unlock_task_sighand(p, &flags);
        }
 
 out:
        rcu_read_unlock();
-       if (!ret)
-               put_pid(ctmr->pid);
 
+       if (!ret) {
+               put_pid(ctmr->pid);
+               timer->it_status = POSIX_TIMER_DISARMED;
+       }
        return ret;
 }