Skip to main content

Browse the archive

https://github.com/torvalds/linux
27 March 2024, 02:37:15 UTC
Revision a69ac4a78d8bd9e1ec478bd7297d4f047fcd44a8 authored by Oleg Nesterov on 24 October 2005, 14:29:58 UTC, committed by Linus Torvalds on 24 October 2005, 15:13:14 UTC 
[PATCH] posix-timers: fix posix_cpu_timer_set() vs run_posix_cpu_timers() race
 
This might be harmless, but looks like a race from code inspection (I
was unable to trigger it).  I must admit, I don't understand why we
can't return TIMER_RETRY after 'spin_unlock(&p->sighand->siglock)'
without doing bump_cpu_timer(), but this is what original code does.

posix_cpu_timer_set:

	read_lock(&tasklist_lock);

	spin_lock(&p->sighand->siglock);
	list_del_init(&timer->it.cpu.entry);
	spin_unlock(&p->sighand->siglock);

We are probaly deleting the timer from run_posix_cpu_timers's 'firing'
local list_head while run_posix_cpu_timers() does list_for_each_safe.

Various bad things can happen, for example we can just delete this timer
so that list_for_each() will not notice it and run_posix_cpu_timers()
will not reset '->firing' flag. In that case,

	....

	if (timer->it.cpu.firing) {
		read_unlock(&tasklist_lock);
		timer->it.cpu.firing = -1;
		return TIMER_RETRY;
	}

sys_timer_settime() goes to 'retry:', calls posix_cpu_timer_set() again,
it returns TIMER_RETRY ...

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
1 parent ca531a0
History
Tip revision: a69ac4a78d8bd9e1ec478bd7297d4f047fcd44a8 authored by Oleg Nesterov on 24 October 2005, 14:29:58 UTC
[PATCH] posix-timers: fix posix_cpu_timer_set() vs run_posix_cpu_timers() race
Tip revision: a69ac4a
File Mode Size
Documentation
arch
crypto
drivers
fs
include
init
ipc
kernel
lib
mm
net
scripts
security
sound
usr
.gitignore -rw-r--r-- 391 bytes
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 87.1 KB
Kbuild -rw-r--r-- 1.2 KB
MAINTAINERS -rw-r--r-- 59.6 KB
Makefile -rw-r--r-- 42.5 KB
README -rw-r--r-- 14.4 KB
REPORTING-BUGS -rw-r--r-- 3.0 KB

README

back to top