Linus noticed that lock_timer_base() lacks a READ_ONCE() for accessing the
timer flags. As a consequence the compiler is allowed to reload the flags
between the initial check for TIMER_MIGRATION and the following timer base
computation and the spin lock of the base.

While this has not been observed (yet), we need to make sure that it never
happens.

Fixes: 0eeda71bc30d ("timer: Replace timer base by a cpu index")
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1610241711220.4983@nanos
Cc: stable@vger.kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>

1 files changed, 3 insertions, 3 deletions

diff --git a/trafgen_lexer.l b/trafgen_lexer.l
index ca5bff9..146d0e7 100644
--- a/trafgen_lexer.l
+++ b/trafgen_lexer.l
@@ -26,7 +26,7 @@ static char *try_convert_shellcode(char *sstr)
 {
 	int j = 0;
 	bool found_any = false;
-	char *bstr, *ostr = sstr, *hay;
+	char *bstr, *ostr = sstr, *hay, *orig = sstr;
 	size_t blen, slen = strlen(sstr), tot = 0;
 	const char *needle = "\\x";
 
@@ -34,7 +34,7 @@ static char *try_convert_shellcode(char *sstr)
 	slen -= 2;
 
 	if (slen % 4 != 0)
-		return sstr;
+		return orig;
 
 	blen = slen / 4;
 	hay = sstr;
@@ -45,7 +45,7 @@ static char *try_convert_shellcode(char *sstr)
 	}
 
 	if (blen != tot || !found_any)
-		return sstr;
+		return orig;
 
 	blen += 2;
 	bstr = xzmalloc(blen);