Hi,

On 10/09/2015 10:24 AM, Felix Hübner wrote:
> Hi all,
>
> I have just reported a concurrency issue in the implementation of
> sem_lock, see https://bugzilla.kernel.org/show_bug.cgi?id=105651
>
> [...]
> # P0 does spin_lock(&sem->lock); in line 336.
>
> 		spin_lock(&sem->lock);
[...]
> # P2 performs rest of semtimedop, increments complex_count and ends up
> in line 1961 and starts to sleep.
>
> 		return -1;
> 	}
That is the problem: semtimedop() increments complex_count - thus 
sem_wait_array() returns without a spin_unlock_wait() loop - but P0 
already owns spin_lock(&sem->lock).

How do we want to fix it?
- revert my patch (simplify code, but slower for one corner case)
- add the missing sem_wait_array (more complex, but also better for 
complex semops).

what do you think?

(patch untested)

--
     Manfred