linux-kernel - [PATCH] posix-timers: cond_resched() during exit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <xm2634gg2n23.fsf@google.com>
Date: Fri, 14 Feb 2025 14:12:20 -0800
From: Benjamin Segall <bsegall@...gle.com>
To: Anna-Maria Behnsen <anna-maria@...utronix.de>, Frederic Weisbecker
 <frederic@...nel.org>,Thomas Gleixner <tglx@...utronix.de>,
 linux-kernel@...r.kernel.org
Cc: Eric Dumazet <edumazet@...gle.com>
Subject: [PATCH] posix-timers: cond_resched() during exit_itimers()

exit_itimers() loops through every timer in the process to delete it.
This requires taking the system-wide hash_lock for each of these locks,
and contends with other processes trying to create or delete timers.
When a process creates hundreds of thousands of timers, and then exits
while other processes contend with it, this can trigger softlockups on
CONFIG_PREEMPT=n.

Ideally this will some day be better solved by eliminating the global
hashtable, but until that point mitigate the issue by doing
cond_resched in that loop.

Signed-off-by: Ben Segall <bsegall@...gle.com>
---
 kernel/time/posix-timers.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index 1b675aee99a98..44ba7db07e900 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -1097,12 +1097,14 @@ void exit_itimers(struct task_struct *tsk)
 	spin_lock_irq(&tsk->sighand->siglock);
 	hlist_move_list(&tsk->signal->posix_timers, &timers);
 	spin_unlock_irq(&tsk->sighand->siglock);
 
 	/* The timers are not longer accessible via tsk::signal */
-	while (!hlist_empty(&timers))
+	while (!hlist_empty(&timers)) {
 		itimer_delete(hlist_entry(timers.first, struct k_itimer, list));
+		cond_resched();
+	}
 
 	/*
 	 * There should be no timers on the ignored list. itimer_delete() has
 	 * mopped them up.
 	 */
-- 
2.48.1.601.g30ceb7b040-goog