Re: [PATCH v1] timers: Feed soft lockup watchdog in expire_timers()

[Thomas Gleixner]

On Fri, Jul 03 2026 at 16:36, tanze@xxxxxxxxxx wrote:

Thanks for your patch.

First of all, you have to provide your real name for signing off on a
patch. Your nickname does not cut it. See Documentation/process.

> expire_timers() iterates over all expired timers and invokes their
> callbacks one by one in softirq context.  Each individual callback may
> complete quickly, but when a very large number of timers expire at the
> same tick, the aggregate time spent in this loop can exceed the soft
> lockup watchdog threshold, causing a false positive:

No. It's not a false positive.

> This is reproducible by issuing many perf_event_open() syscalls with
> PERF_COUNT_SW_CPU_CLOCK and a very small sample_period, which creates
> a large number of software timers that expire simultaneously.  The CPU
> is making forward progress -- executing timer callbacks one after
> another -- but the watchdog is never reset during the batch.  Found by
> running syzkaller on a local QEMU instance.

The watchdog validates that the CPU is making forward progress for
tasks. Spending 26 seconds in soft interrupt handling does therefore not
qualify.

> Add touch_softlockup_watchdog() after each call_timer_fn() invocation
> in expire_timers().  This resets the watchdog timestamp after every
> successfully completed callback.

Which papers over the underlying problem.

> @@ -1792,11 +1793,13 @@ static void expire_timers(struct timer_base *base, struct hlist_head *head)
>  		if (timer->flags & TIMER_IRQSAFE) {
>  			raw_spin_unlock(&base->lock);
>  			call_timer_fn(timer, fn, baseclk);
> +			touch_softlockup_watchdog();
>  			raw_spin_lock(&base->lock);
>  			base->running_timer = NULL;
>  		} else {
>  			raw_spin_unlock_irq(&base->lock);
>  			call_timer_fn(timer, fn, baseclk);
> +			touch_softlockup_watchdog();
>  			raw_spin_lock_irq(&base->lock);
>  			base->running_timer = NULL;
>  			timer_sync_wait_running(base);

PERF_COUNT_SW_CPU_CLOCK does not even use timer list timers, so how is
expire_timers() even involved?

Thanks,

        tglx