[PATCH] posix-timers: fix IRQ state handling in posix_timer_delete()

[pavankumaryalagada]

From: Yalagada Pavan Kumar <pavankumaryalagada@xxxxxxxxx>

exit_itimers() uses a spinlock_irq guard for timer->it_lock, which
maintains counted IRQ-disable state. However, posix_timer_delete()
temporarily releases and reacquires the lock with spin_unlock_irq()
and spin_lock_irq(), which do not maintain the same IRQ-disable state
while timer_wait_running() may sleep.

Use spin_unlock_irq_enable() and spin_lock_irq_disable() for the
temporary lock handoff to keep the IRQ-disable state balanced.

Reported-by: syzbot+143e0859898751aa8f94@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=143e0859898751aa8f94
Tested-by: syzbot+143e0859898751aa8f94@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Yalagada Pavan Kumar <pavankumaryalagada@xxxxxxxxx>
---
 kernel/time/posix-timers.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index 436ba794cc0b..5e580b4223de 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -1057,9 +1057,9 @@ static void posix_timer_delete(struct k_itimer *timer)
 
 	while (timer->kclock->timer_del(timer) == TIMER_RETRY) {
 		guard(rcu)();
-		spin_unlock_irq(&timer->it_lock);
+		spin_unlock_irq_enable(&timer->it_lock);
 		timer_wait_running(timer);
-		spin_lock_irq(&timer->it_lock);
+		spin_lock_irq_disable(&timer->it_lock);
 	}
 }
 
-- 
2.43.0