https://github.com/torvalds/linux
Revision 108150ea78003044e41150c75259447b2c0953b6 authored by Oleg Nesterov on 23 October 2005, 16:25:39 UTC, committed by Linus Torvalds on 24 October 2005, 15:12:35 UTC
1. cleanup_timers() sets timer->task = NULL under tasklist + ->sighand locks.
   That means that this code in posix_cpu_timer_del() and posix_cpu_timer_set()

   		lock_timer(timer);
		if (timer->task == NULL)
			return;
		read_lock(tasklist);
		put_task_struct(timer->task)

   is racy. With this patch timer->task modified and accounted only under
   timer->it_lock. Sadly, this means that dead task_struct won't be freed
   until timer deleted or armed.

2. run_posix_cpu_timers() collects expired timers into local list under
   tasklist + ->sighand again. That means that posix_cpu_timer_del()
   should check timer->it.cpu.firing under these locks too.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
1 parent ba9e358
History
Tip revision: 108150ea78003044e41150c75259447b2c0953b6 authored by Oleg Nesterov on 23 October 2005, 16:25:39 UTC
[PATCH] posix-timers: fix cleanup_timers() and run_posix_cpu_timers() races
Tip revision: 108150e
File Mode Size
Documentation
arch
crypto
drivers
fs
include
init
ipc
kernel
lib
mm
net
scripts
security
sound
usr
.gitignore -rw-r--r-- 391 bytes
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 87.1 KB
Kbuild -rw-r--r-- 1.2 KB
MAINTAINERS -rw-r--r-- 59.6 KB
Makefile -rw-r--r-- 42.5 KB
README -rw-r--r-- 14.4 KB
REPORTING-BUGS -rw-r--r-- 3.0 KB

README

back to top