Home » Mailing list archives » linux-kernel » 2008 » May » 3

[PATCH 4/4] posix timers: release_posix_timer: kill the bogus put_task_struct(->it_process);

!MAILaRCHIVE_VOTE_RePLACE
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: Oleg Nesterov <oleg@...>
To: Andrew Morton <akpm@...>
Cc: Austin Clements <amdragon+kernelbugzilla@...>, Ingo Molnar <mingo@...>, john stultz <johnstul@...>, Linus Torvalds <torvalds@...>, Michael Kerrisk <mtk.manpages@...>, Roland McGrath <roland@...>, Thomas Gleixner <tglx@...>, <linux-kernel@...>
Subject: [PATCH 4/4] posix timers: release_posix_timer: kill the bogus put_task_struct(-&gt;it_process);
Date: Saturday, May 3, 2008 - 1:35 pm

release_posix_timer() can't be called with ->it_process != NULL. Once
sys_timer_create() sets ->it_process it must not call release_posix_timer(),
otherwise we can race with another thread doing sys_timer_delete(), this timer
is visible to idr_find() and unlocked.

The same is true for two other callers (actually, for any possible caller),
sys_timer_delete() and itimer_delete(). They must clear ->it_process before
unlock_timer() + release_posix_timer().

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>

--- 25/kernel/posix-timers.c~4_RPT_NO_CHECK	2008-05-03 19:55:27.000000000 +0400
+++ 25/kernel/posix-timers.c	2008-05-03 20:13:36.000000000 +0400
@@ -450,9 +450,6 @@ static void release_posix_timer(struct k
 		spin_unlock_irqrestore(&idr_lock, flags);
 	}
 	sigqueue_free(tmr->sigq);
-	if (unlikely(tmr->it_process) &&
-	    tmr->it_sigev_notify == (SIGEV_SIGNAL|SIGEV_THREAD_ID))
-		put_task_struct(tmr->it_process);
 	kmem_cache_free(posix_timers_cache, tmr);
 }
 

--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
[PATCH 4/4] posix timers: release_posix_timer: kill the bogu..., Oleg Nesterov, (Sat May 3, 1:35 pm)
Re: [PATCH 4/4] posix timers: release_posix_timer: kill the ..., Roland McGrath, (Mon May 5, 10:34 pm)