[patch] pi-futex: missing pi_waiters plist initialization

[patch] pi-futex: missing pi_waiters plist initialization

[Heiko Carstens]

From: Heiko Carstens <heiko.carstens@de.ibm.com>

Initialize init task's pi_waiters plist. Otherwise cpu hotplug of cpu 0
might crash, since rt_mutex_getprio() accesses an uninitialized list head.

call chain which led to crash:

take_cpu_down
sched_idle_next
__setscheduler
rt_mutex_getprio

Using PLIST_HEAD_INIT in the INIT_TASK macro doesn't work unfortunately, since
the pi_waiters member is only conditionally present.

Cc: Arjan van de Ven <arjan@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
---

 kernel/sched.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/sched.c b/kernel/sched.c
index b44b9a4..db1014d 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -6761,6 +6761,11 @@ #endif
 	}
 
 	set_load_weight(&init_task);
+
+#ifdef CONFIG_RT_MUTEXES
+	plist_head_init(&init_task.pi_waiters, &init_task.pi_lock);
+#endif
+
 	/*
 	 * The boot idle thread does lazy MMU switching as well:
 	 */

Re: [patch] pi-futex: missing pi_waiters plist initialization

[Sharyathi Nagesh]

[-- Attachment #1: Type: text/plain, Size: 935 bytes --]

On Mon, 2006-07-24 at 13:21 +0200, Heiko Carstens wrote:
> From: Heiko Carstens <heiko.carstens@de.ibm.com>
> 
> Initialize init task's pi_waiters plist. Otherwise cpu hotplug of cpu 0
> might crash, since rt_mutex_getprio() accesses an uninitialized list head.
> 
> call chain which led to crash:
> 
> take_cpu_down
> sched_idle_next
> __setscheduler
> rt_mutex_getprio
> 
> Using PLIST_HEAD_INIT in the INIT_TASK macro doesn't work unfortunately, since
> the pi_waiters member is only conditionally present.

Hi 
     I felt it would be more appropriate to put initialization of
pi_waiters in fork_init function rather than in sched_init function as
other init_task related initialization or happening in fork_init(). As
well we have rt_mutex_init_task() function in fork.c which can be reused
for initializing pi_waiters field of init_task. 
    Please go through the patch and let me know of your opinion.
Thanks 
Sharyathi Nagesh

[-- Attachment #2: pi_waiters.patch --]
[-- Type: text/x-patch, Size: 1288 bytes --]

Signed-off-by: <sharyath@in.ibm.com>
----


Index: linux-2.6.18-rc4/kernel/fork.c
===================================================================
--- linux-2.6.18-rc4.orig/kernel/fork.c	2006-08-06 23:50:11.000000000 +0530
+++ linux-2.6.18-rc4/kernel/fork.c	2006-08-22 13:03:03.000000000 +0530
@@ -122,6 +122,16 @@
 		free_task(tsk);
 }
 
+
+static inline void rt_mutex_init_task(struct task_struct *p)
+{
+#ifdef CONFIG_RT_MUTEXES
+	spin_lock_init(&p->pi_lock);
+	plist_head_init(&p->pi_waiters, &p->pi_lock);
+	p->pi_blocked_on = NULL;
+#endif
+}
+
 void __init fork_init(unsigned long mempages)
 {
 #ifndef __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
@@ -151,6 +161,7 @@
 	init_task.signal->rlim[RLIMIT_NPROC].rlim_max = max_threads/2;
 	init_task.signal->rlim[RLIMIT_SIGPENDING] =
 		init_task.signal->rlim[RLIMIT_NPROC];
+	rt_mutex_init_task(&init_task);
 }
 
 static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -919,15 +930,6 @@
 	return current->pid;
 }
 
-static inline void rt_mutex_init_task(struct task_struct *p)
-{
-#ifdef CONFIG_RT_MUTEXES
-	spin_lock_init(&p->pi_lock);
-	plist_head_init(&p->pi_waiters, &p->pi_lock);
-	p->pi_blocked_on = NULL;
-#endif
-}
-
 /*
  * This creates a new process as a copy of the old one,
  * but does not actually start it yet.