)]}'
{
  "commit": "ca7752caeaa70bd31d1714af566c9809688544af",
  "tree": "bac75720c7d11bf46a6ef310a98680d99954d99d",
  "parents": [
    "879dbe9ffebc1328717cd66eab7e4918a3f499bd"
  ],
  "author": {
    "name": "Michael Pratt",
    "email": "mpratt@google.com",
    "time": "Mon Nov 01 17:06:15 2021 -0400"
  },
  "committer": {
    "name": "Thomas Gleixner",
    "email": "tglx@linutronix.de",
    "time": "Tue Nov 02 12:52:17 2021 +0100"
  },
  "message": "posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()\n\ncopy_process currently copies task_struct.posix_cputimers_work as-is. If a\ntimer interrupt arrives while handling clone and before dup_task_struct\ncompletes then the child task will have:\n\n1. posix_cputimers_work.scheduled \u003d true\n2. posix_cputimers_work.work queued.\n\ncopy_process clears task_struct.task_works, so (2) will have no effect and\nposix_cpu_timers_work will never run (not to mention it doesn\u0027t make sense\nfor two tasks to share a common linked list).\n\nSince posix_cpu_timers_work never runs, posix_cputimers_work.scheduled is\nnever cleared. Since scheduled is set, future timer interrupts will skip\nscheduling work, with the ultimate result that the task will never receive\ntimer expirations.\n\nTogether, the complete flow is:\n\n1. Task 1 calls clone(), enters kernel.\n2. Timer interrupt fires, schedules task work on Task 1.\n   2a. task_struct.posix_cputimers_work.scheduled \u003d true\n   2b. task_struct.posix_cputimers_work.work added to\n       task_struct.task_works.\n3. dup_task_struct() copies Task 1 to Task 2.\n4. copy_process() clears task_struct.task_works for Task 2.\n5. Future timer interrupts on Task 2 see\n   task_struct.posix_cputimers_work.scheduled \u003d true and skip scheduling\n   work.\n\nFix this by explicitly clearing contents of task_struct.posix_cputimers_work\nin copy_process(). This was never meant to be shared or inherited across\ntasks in the first place.\n\nFixes: 1fb497dd0030 (\"posix-cpu-timers: Provide mechanisms to defer timer handling to task_work\")\nReported-by: Rhys Hiltner \u003crhys@justin.tv\u003e\nSigned-off-by: Michael Pratt \u003cmpratt@google.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nLink: https://lore.kernel.org/r/20211101210615.716522-1-mpratt@google.com\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "00fef0064355fee5fd500b6c3d34dc2cc160f06b",
      "old_mode": 33188,
      "old_path": "include/linux/posix-timers.h",
      "new_id": "5bbcd280bfd267bcab32e766725c4350af0b8f89",
      "new_mode": 33188,
      "new_path": "include/linux/posix-timers.h"
    },
    {
      "type": "modify",
      "old_id": "8e9feeef555e7f0650f07d84fa51f214c3c98b14",
      "old_mode": 33188,
      "old_path": "kernel/fork.c",
      "new_id": "8269ae2e5d7c510ccdccc761e8f5fd65066263d5",
      "new_mode": 33188,
      "new_path": "kernel/fork.c"
    },
    {
      "type": "modify",
      "old_id": "643d412ac6235eae110975f60247c97a8f278225",
      "old_mode": 33188,
      "old_path": "kernel/time/posix-cpu-timers.c",
      "new_id": "96b4e78104266fc6b3736de89ee20dbd49e02284",
      "new_mode": 33188,
      "new_path": "kernel/time/posix-cpu-timers.c"
    }
  ]
}