diff options
| author | Oleg Nesterov <oleg@tv-sign.ru> | 2005-10-23 18:25:39 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2005-10-24 17:12:35 +0200 |
| commit | 108150ea78003044e41150c75259447b2c0953b6 (patch) | |
| tree | ffe0b7e59e6ca1c8a4dad18110e485e5c72872bc /kernel/exit.c | |
| parent | Merge master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-for-linus-2.6 (diff) | |
| download | linux-108150ea78003044e41150c75259447b2c0953b6.tar.xz linux-108150ea78003044e41150c75259447b2c0953b6.zip | |
[PATCH] posix-timers: fix cleanup_timers() and run_posix_cpu_timers() races
1. cleanup_timers() sets timer->task = NULL under tasklist + ->sighand locks.
That means that this code in posix_cpu_timer_del() and posix_cpu_timer_set()
lock_timer(timer);
if (timer->task == NULL)
return;
read_lock(tasklist);
put_task_struct(timer->task)
is racy. With this patch timer->task modified and accounted only under
timer->it_lock. Sadly, this means that dead task_struct won't be freed
until timer deleted or armed.
2. run_posix_cpu_timers() collects expired timers into local list under
tasklist + ->sighand again. That means that posix_cpu_timer_del()
should check timer->it.cpu.firing under these locks too.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'kernel/exit.c')
0 files changed, 0 insertions, 0 deletions