]> err.no Git - linux-2.6/commit
[PATCH] posix-timers: fix posix_cpu_timer_set() vs run_posix_cpu_timers() race
authorOleg Nesterov <oleg@tv-sign.ru>
Mon, 24 Oct 2005 14:29:58 +0000 (18:29 +0400)
committerLinus Torvalds <torvalds@g5.osdl.org>
Mon, 24 Oct 2005 15:13:14 +0000 (08:13 -0700)
commita69ac4a78d8bd9e1ec478bd7297d4f047fcd44a8
treea56edf4f69cc01c6d4b7b3eeee3646c7ea9810df
parentca531a0a5e01e5122f67cb6aca8fcbfc70e18e0b
[PATCH] posix-timers: fix posix_cpu_timer_set() vs run_posix_cpu_timers() race

This might be harmless, but looks like a race from code inspection (I
was unable to trigger it).  I must admit, I don't understand why we
can't return TIMER_RETRY after 'spin_unlock(&p->sighand->siglock)'
without doing bump_cpu_timer(), but this is what original code does.

posix_cpu_timer_set:

read_lock(&tasklist_lock);

spin_lock(&p->sighand->siglock);
list_del_init(&timer->it.cpu.entry);
spin_unlock(&p->sighand->siglock);

We are probaly deleting the timer from run_posix_cpu_timers's 'firing'
local list_head while run_posix_cpu_timers() does list_for_each_safe.

Various bad things can happen, for example we can just delete this timer
so that list_for_each() will not notice it and run_posix_cpu_timers()
will not reset '->firing' flag. In that case,

....

if (timer->it.cpu.firing) {
read_unlock(&tasklist_lock);
timer->it.cpu.firing = -1;
return TIMER_RETRY;
}

sys_timer_settime() goes to 'retry:', calls posix_cpu_timer_set() again,
it returns TIMER_RETRY ...

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
kernel/posix-cpu-timers.c