]> err.no Git - linux-2.6/commit
[PATCH] posix-timers: fix cleanup_timers() and run_posix_cpu_timers() races
authorOleg Nesterov <oleg@tv-sign.ru>
Sun, 23 Oct 2005 16:25:39 +0000 (20:25 +0400)
committerLinus Torvalds <torvalds@g5.osdl.org>
Mon, 24 Oct 2005 15:12:35 +0000 (08:12 -0700)
commit108150ea78003044e41150c75259447b2c0953b6
treeffe0b7e59e6ca1c8a4dad18110e485e5c72872bc
parentba9e358fd04190a59e605c2963a15e014139a707
[PATCH] posix-timers: fix cleanup_timers() and run_posix_cpu_timers() races

1. cleanup_timers() sets timer->task = NULL under tasklist + ->sighand locks.
   That means that this code in posix_cpu_timer_del() and posix_cpu_timer_set()

    lock_timer(timer);
if (timer->task == NULL)
return;
read_lock(tasklist);
put_task_struct(timer->task)

   is racy. With this patch timer->task modified and accounted only under
   timer->it_lock. Sadly, this means that dead task_struct won't be freed
   until timer deleted or armed.

2. run_posix_cpu_timers() collects expired timers into local list under
   tasklist + ->sighand again. That means that posix_cpu_timer_del()
   should check timer->it.cpu.firing under these locks too.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
kernel/posix-cpu-timers.c