fsm_addtimer() calls timer_setup() unconditionally before add_timer(). If called on an already-pending timer, timer_setup() re-initializes the timer's list_head fields while the timer is still enqueued in the wheel, corrupting the timer list. The timer is already initialized once by fsm_settimer() which calls timer_setup() correctly. Multiple callsites invoke fsm_addtimer() without a preceding fsm_deltimer(), including ctcm_main.c ctcmpc_send_sweep_req() and ctcm_mpc.c mpc_action_side_xid(), making the redundant timer_setup() in fsm_addtimer() a real corruption risk. Remove the redundant timer_setup() calls from fsm_addtimer() and fsm_modtimer(), and replace add_timer() with mod_timer() which safely handles both pending and non-pending timers atomically without corrupting the timer wheel. Fixes: e99e88a9d2b0 ("treewide: setup_timer() -> timer_setup()") Cc: stable@vger.kernel.org Reported-by: Sashiko Link: https://sashiko.dev/#/patchset/20260803182736.2356374-1-nagamani@linux.ibm.com?part=1 Reviewed-by: Aswin Karuvally Tested-by: Aswin Karuvally Signed-off-by: Nagamani PV --- Changes in v3: - No changes to this patch. Changes in v2: - fix function name ctcm_send_sweep() -> ctcmpc_send_sweep_req() in the commit message (Sashiko netdev-bot) - call mod_timer() then return 0 explicitly, preserving the "Always returns 0" contract documented in fsm.h (Sashiko netdev-bot) --- drivers/s390/net/fsm.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/s390/net/fsm.c b/drivers/s390/net/fsm.c index 9b8622aef807..936ed0bc8401 100644 --- a/drivers/s390/net/fsm.c +++ b/drivers/s390/net/fsm.c @@ -171,11 +171,9 @@ fsm_addtimer(fsm_timer *this, int millisec, int event, void *arg) this->fi->name, this, millisec); #endif - timer_setup(&this->tl, fsm_expire_timer, 0); this->expire_event = event; this->event_arg = arg; - this->tl.expires = jiffies + (millisec * HZ) / 1000; - add_timer(&this->tl); + mod_timer(&this->tl, jiffies + msecs_to_jiffies(millisec)); return 0; } @@ -189,12 +187,9 @@ fsm_modtimer(fsm_timer *this, int millisec, int event, void *arg) this->fi->name, this, millisec); #endif - timer_delete(&this->tl); - timer_setup(&this->tl, fsm_expire_timer, 0); this->expire_event = event; this->event_arg = arg; - this->tl.expires = jiffies + (millisec * HZ) / 1000; - add_timer(&this->tl); + mod_timer(&this->tl, jiffies + msecs_to_jiffies(millisec)); } EXPORT_SYMBOL(init_fsm); -- 2.53.0