linux-kernel - [PATCH] rtc: interface: Fix softlockup in rtc_timer_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251231092321.3787542-1-ruanjinjie@huawei.com>
Date: Wed, 31 Dec 2025 17:23:21 +0800
From: Jinjie Ruan <ruanjinjie@...wei.com>
To: <alexandre.belloni@...tlin.com>, <linux-rtc@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>
CC: <ruanjinjie@...wei.com>
Subject: [PATCH] rtc: interface: Fix softlockup in rtc_timer_do_work()

On kvm qemu with cmos rtc and mc146818 chip, when the read time jump to
a future time after set the uie timer expire with a current RTC time,
rtc_timer_do_work() will loop for a while util softlockup because
the expiration of the uie timer was way before the current
RTC time and a new timer will be enqueued until the current rtc time
is reached, as below:

Fix it by voluntarily yield the CPU in the loop in rtc_timer_do_work().

RTC_UIE_ON:
	read now: 2019:04:08:12:32:27, add timer0 (expire: 2019:04:08:12:32:28)
		 ^^^^^^^^^^^^^^^^^^^^
...
rtc_timer_do_work() iterate the list in a loop:
	read now: 2033:12:02:07:27:15
		  ^^^^^^^^^^^^^^^^^^^
	handle timer0, add timer1 to the list (expire: 2019:04:08:12:32:29)
	handle timer1, add timer2 to the list (expire: 2019:04:08:12:32:30)
	handle timer2, add timer3: 2019:04:08:12:32:31
	...
	-> softlockup

Signed-off-by: Jinjie Ruan <ruanjinjie@...wei.com>
---
 drivers/rtc/interface.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index b8b298efd9a9..9ded10e82f4b 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -964,6 +964,7 @@ void rtc_timer_do_work(struct work_struct *work)
 			timer->enabled = 1;
 			timerqueue_add(&rtc->timerqueue, &timer->node);
 			trace_rtc_timer_enqueue(timer);
+			cond_resched();
 		}
 	}
 
-- 
2.34.1