hrtimer: Don't dereference the hrtimer pointer after the callback
authorSebastian Andrzej Siewior <bigeasy@linutronix.de>
Tue, 31 Mar 2020 20:18:49 +0000 (22:18 +0200)
committerThomas Gleixner <tglx@linutronix.de>
Wed, 1 Apr 2020 11:20:14 +0000 (13:20 +0200)
commit73d20564e0dcae003e0d79977f044d5e57496304
tree10e1f109985f6da880de947d076646bd33fac2e9
parent42595ce90b9d4a6b9d8c5a1ea78da4eeaf7e086a
hrtimer: Don't dereference the hrtimer pointer after the callback

A hrtimer can be released in its callback, but lockdep_hrtimer_exit()
dereferences the pointer after the callback returns, i.e. a potential use
after free.

Retrieve the context in which the hrtimer expires before the callback is
invoked and use it in lockdep_hrtimer_exit().

Fixes: 40db173965c0 ("lockdep: Add hrtimer context tracing bits")
Reported-by: syzbot+62c155c276e580cfb606@syzkaller.appspotmail.com
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20200331201849.fkp2siy3vcdqvqlz@linutronix.de
include/linux/irqflags.h
kernel/time/hrtimer.c