]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
alarmtimer: Access timerqueue node under lock in suspend
authorZhan Xusheng <zhanxusheng1024@gmail.com>
Tue, 7 Apr 2026 14:36:27 +0000 (22:36 +0800)
committerThomas Gleixner <tglx@kernel.org>
Tue, 7 Apr 2026 17:14:26 +0000 (19:14 +0200)
commit09c04714cb455debc1dcc3535b6becb52c5b01e0
tree90661505dce3e5d22210b9ea849b53172c81a290
parentc5283a1ffdd5a877120279d164e9d5761e8455af
alarmtimer: Access timerqueue node under lock in suspend

In alarmtimer_suspend(), timerqueue_getnext() is called under
base->lock, but next->expires is read after the lock is released.

This is safe because suspend freezes all relevant task contexts,
but reading the node while holding the lock makes the code easier
to reason about and not worry about a theoretical UAF.

Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260407143627.19405-1-zhanxusheng@xiaomi.com
kernel/time/alarmtimer.c