1
linux/kernel
Oleg Nesterov a69ac4a78d [PATCH] posix-timers: fix posix_cpu_timer_set() vs run_posix_cpu_timers() race
This might be harmless, but looks like a race from code inspection (I
was unable to trigger it).  I must admit, I don't understand why we
can't return TIMER_RETRY after 'spin_unlock(&p->sighand->siglock)'
without doing bump_cpu_timer(), but this is what original code does.

posix_cpu_timer_set:

	read_lock(&tasklist_lock);

	spin_lock(&p->sighand->siglock);
	list_del_init(&timer->it.cpu.entry);
	spin_unlock(&p->sighand->siglock);

We are probaly deleting the timer from run_posix_cpu_timers's 'firing'
local list_head while run_posix_cpu_timers() does list_for_each_safe.

Various bad things can happen, for example we can just delete this timer
so that list_for_each() will not notice it and run_posix_cpu_timers()
will not reset '->firing' flag. In that case,

	....

	if (timer->it.cpu.firing) {
		read_unlock(&tasklist_lock);
		timer->it.cpu.firing = -1;
		return TIMER_RETRY;
	}

sys_timer_settime() goes to 'retry:', calls posix_cpu_timer_set() again,
it returns TIMER_RETRY ...

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-24 08:13:14 -07:00
..
irq
power [PATCH] x86_64: Set up safe page tables during resume 2005-10-10 08:36:46 -07:00
acct.c
audit.c [PATCH] gfp flags annotations - part 1 2005-10-08 15:00:57 -07:00
auditsc.c
capability.c
compat.c
configs.c
cpu.c
cpuset.c [PATCH] gfp flags annotations - part 1 2005-10-08 15:00:57 -07:00
crash_dump.c
dma.c
exec_domain.c
exit.c [PATCH] posix-timers: remove false BUG_ON() from run_posix_cpu_timers() 2005-10-24 08:12:35 -07:00
extable.c
fork.c [PATCH] Threads shouldn't inherit PF_NOFREEZE 2005-10-19 23:04:31 -07:00
futex.c
intermodule.c
itimer.c
kallsyms.c
Kconfig.hz
Kconfig.preempt
kexec.c
kfifo.c [PATCH] gfp flags annotations - part 1 2005-10-08 15:00:57 -07:00
kmod.c
kprobes.c
ksysfs.c
kthread.c
Makefile
module.c
panic.c
params.c [PATCH] Ignore trailing whitespace on kernel parameters correctly 2005-09-28 07:46:41 -07:00
pid.c
posix-cpu-timers.c [PATCH] posix-timers: fix posix_cpu_timer_set() vs run_posix_cpu_timers() race 2005-10-24 08:13:14 -07:00
posix-timers.c [PATCH] Call exit_itimers from do_exit, not __exit_signal 2005-10-21 15:38:08 -07:00
printk.c [PATCH] Add printk_clock() 2005-09-21 10:11:54 -07:00
profile.c
ptrace.c
rcupdate.c [PATCH] rcu: keep rcu callback event counter 2005-10-17 15:27:58 -07:00
resource.c
sched.c
seccomp.c
signal.c [PATCH] Call exit_itimers from do_exit, not __exit_signal 2005-10-21 15:38:08 -07:00
softirq.c
softlockup.c
spinlock.c
stop_machine.c
sys_ni.c
sys.c [PATCH] reboot: comment and factor the main reboot functions 2005-09-22 22:17:33 -07:00
sysctl.c
time.c [PATCH] Add missing export of getnstimeofday() 2005-10-14 17:10:12 -07:00
timer.c
uid16.c
user.c
wait.c
workqueue.c