[PATCH] POSIX timers SMP race condition

[PATCH] POSIX timers SMP race condition

Post by Arun Sharm » Sun, 25 Sep 2005 08:00:12


Fix run_posix_cpu_timers()/do_exit() race condition

CPU0:

do_exit()
tsk->flags |= PF_EXITING;
/* Make sure we don't try to process any timer firings
* while we are already exiting.
*/
tsk->it_virt_expires = cputime_zero;
tsk->it_prof_expires = cputime_zero;
tsk->it_sched_expires = 0;

<window>

exit_notify()
tsk->exit_state = xxx;

CPU1 (executes this code in the <window>):

setitimer()
process_timer_rebalance()
tsk->it_prof_expires=xxx;

This triggers the BUG_ON(tsk->exit_state) in run_posix_cpu_timers().

Signed-off-by: Arun Sharma < XXXX@XXXXX.COM >

--- linux-2.6.12/kernel/posix-cpu-timers.c- 2005-09-22 04:10:16.000000000 -0700
+++ linux-2.6.12/kernel/posix-cpu-timers.c 2005-09-22 04:10:18.000000000 -0700
@@ -500,7 +500,7 @@
left = cputime_div(cputime_sub(expires.cpu, val.cpu),
nthreads);
do {
- if (!unlikely(t->exit_state)) {
+ if (!unlikely(t->flags & PF_EXITING)) {
ticks = cputime_add(prof_ticks(t), left);
if (cputime_eq(t->it_prof_expires,
cputime_zero) ||
@@ -515,7 +515,7 @@
left = cputime_div(cputime_sub(expires.cpu, val.cpu),
nthreads);
do {
- if (!unlikely(t->exit_state)) {
+ if (!unlikely(t->flags & PF_EXITING)) {
ticks = cputime_add(virt_ticks(t), left);
if (cputime_eq(t->it_virt_expires,
cputime_zero) ||
@@ -530,7 +530,7 @@
nsleft = expires.sched - val.sched;
do_div(nsleft, nthreads);
do {
- if (!unlikely(t->exit_state)) {
+ if (!unlikely(t->flags & PF_EXITING)) {
ns = t->sched_time + nsleft;
if (t->it_sched_expires == 0 ||
t->it_sched_expires > ns) {
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to XXXX@XXXXX.COM
More majordomo info at http://www.yqcomputer.com/
Please read the FAQ at http://www.yqcomputer.com/
 
 
 

[PATCH] POSIX timers SMP race condition

Post by Arun Sharm » Sun, 25 Sep 2005 09:20:06


I just had this problem happen again, after the patch. It looks like we
need to cover other unguarded assignments to tsk->it_prof_expires,
which could possibly race with do_exit().

Or just check for PF_EXITING in run_posix_cpu_timers() and return.

-Arun
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to XXXX@XXXXX.COM
More majordomo info at http://www.yqcomputer.com/
Please read the FAQ at http://www.yqcomputer.com/

 
 
 

[PATCH] POSIX timers SMP race condition

Post by Arun Sharm » Fri, 30 Sep 2005 06:40:25


False alarm, sorry. The kernel turned out be unpatched. I haven't seen
the BUG() since then.

-Arun
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to XXXX@XXXXX.COM
More majordomo info at http://www.yqcomputer.com/
Please read the FAQ at http://www.yqcomputer.com/