* [PATCH 4/4] posix timers: release_posix_timer: kill the bogus put_task_struct(->it_process);
@ 2008-05-03 17:35 Oleg Nesterov
2008-05-06 2:34 ` Roland McGrath
0 siblings, 1 reply; 2+ messages in thread
From: Oleg Nesterov @ 2008-05-03 17:35 UTC (permalink / raw)
To: Andrew Morton
Cc: Austin Clements, Ingo Molnar, john stultz, Linus Torvalds,
Michael Kerrisk, Roland McGrath, Thomas Gleixner, linux-kernel
release_posix_timer() can't be called with ->it_process != NULL. Once
sys_timer_create() sets ->it_process it must not call release_posix_timer(),
otherwise we can race with another thread doing sys_timer_delete(), this timer
is visible to idr_find() and unlocked.
The same is true for two other callers (actually, for any possible caller),
sys_timer_delete() and itimer_delete(). They must clear ->it_process before
unlock_timer() + release_posix_timer().
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
--- 25/kernel/posix-timers.c~4_RPT_NO_CHECK 2008-05-03 19:55:27.000000000 +0400
+++ 25/kernel/posix-timers.c 2008-05-03 20:13:36.000000000 +0400
@@ -450,9 +450,6 @@ static void release_posix_timer(struct k
spin_unlock_irqrestore(&idr_lock, flags);
}
sigqueue_free(tmr->sigq);
- if (unlikely(tmr->it_process) &&
- tmr->it_sigev_notify == (SIGEV_SIGNAL|SIGEV_THREAD_ID))
- put_task_struct(tmr->it_process);
kmem_cache_free(posix_timers_cache, tmr);
}
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH 4/4] posix timers: release_posix_timer: kill the bogus put_task_struct(->it_process);
2008-05-03 17:35 [PATCH 4/4] posix timers: release_posix_timer: kill the bogus put_task_struct(->it_process); Oleg Nesterov
@ 2008-05-06 2:34 ` Roland McGrath
0 siblings, 0 replies; 2+ messages in thread
From: Roland McGrath @ 2008-05-06 2:34 UTC (permalink / raw)
To: Oleg Nesterov
Cc: Andrew Morton, Austin Clements, Ingo Molnar, john stultz,
Linus Torvalds, Michael Kerrisk, Thomas Gleixner, linux-kernel
Signed-off-by: Roland McGrath <roland@redhat.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2008-05-06 2:34 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2008-05-03 17:35 [PATCH 4/4] posix timers: release_posix_timer: kill the bogus put_task_struct(->it_process); Oleg Nesterov
2008-05-06 2:34 ` Roland McGrath
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®