DragonFlyBSD Kernel Audit
DF-2174 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/linux_hrtimer.c b/sys/dev/drm/linux_hrtimer.c
--- a/sys/dev/drm/linux_hrtimer.c
+++ b/sys/dev/drm/linux_hrtimer.c
@@ -53,11 +53,15 @@
 		goto done;
 	}
 	lwkt_reltoken(&timer->timer_token);
+
+	/* The oneshot that fired is done; clear active.
+	 * Callback may re-arm via hrtimer_start (sets active=true). */
+	timer->active = false;
 	KKASSERT(timer->function != NULL);
 	restart = timer->function(timer);
 	lwkt_gettoken(&timer->timer_token);
 	timer->running = false;
-	timer->active = false;
+	/* Do NOT unconditionally clear active: callback may have re-armed. */
 	if (!timer->cancel && restart == HRTIMER_RESTART) {
 		KKASSERT(timer->is_rel);
 		timer->active = true;