Commit 67a077dc authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'timers-fixes-for-linus' of...

Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  posix-timers: fix posix_timer_event() vs dequeue_signal() race
  posix-timers: do_schedule_next_timer: fix the setting of ->si_overrun
parents 9b4d0bab 2106b531
...@@ -289,21 +289,29 @@ void do_schedule_next_timer(struct siginfo *info) ...@@ -289,21 +289,29 @@ void do_schedule_next_timer(struct siginfo *info)
else else
schedule_next_timer(timr); schedule_next_timer(timr);
info->si_overrun = timr->it_overrun_last; info->si_overrun += timr->it_overrun_last;
} }
if (timr) if (timr)
unlock_timer(timr, flags); unlock_timer(timr, flags);
} }
int posix_timer_event(struct k_itimer *timr,int si_private) int posix_timer_event(struct k_itimer *timr, int si_private)
{ {
memset(&timr->sigq->info, 0, sizeof(siginfo_t)); /*
* FIXME: if ->sigq is queued we can race with
* dequeue_signal()->do_schedule_next_timer().
*
* If dequeue_signal() sees the "right" value of
* si_sys_private it calls do_schedule_next_timer().
* We re-queue ->sigq and drop ->it_lock().
* do_schedule_next_timer() locks the timer
* and re-schedules it while ->sigq is pending.
* Not really bad, but not that we want.
*/
timr->sigq->info.si_sys_private = si_private; timr->sigq->info.si_sys_private = si_private;
/* Send signal to the process that owns this timer.*/
timr->sigq->info.si_signo = timr->it_sigev_signo; timr->sigq->info.si_signo = timr->it_sigev_signo;
timr->sigq->info.si_errno = 0;
timr->sigq->info.si_code = SI_TIMER; timr->sigq->info.si_code = SI_TIMER;
timr->sigq->info.si_tid = timr->it_id; timr->sigq->info.si_tid = timr->it_id;
timr->sigq->info.si_value = timr->it_sigev_value; timr->sigq->info.si_value = timr->it_sigev_value;
...@@ -435,6 +443,7 @@ static struct k_itimer * alloc_posix_timer(void) ...@@ -435,6 +443,7 @@ static struct k_itimer * alloc_posix_timer(void)
kmem_cache_free(posix_timers_cache, tmr); kmem_cache_free(posix_timers_cache, tmr);
tmr = NULL; tmr = NULL;
} }
memset(&tmr->sigq->info, 0, sizeof(siginfo_t));
return tmr; return tmr;
} }
......
...@@ -1304,6 +1304,7 @@ int send_sigqueue(struct sigqueue *q, struct task_struct *t, int group) ...@@ -1304,6 +1304,7 @@ int send_sigqueue(struct sigqueue *q, struct task_struct *t, int group)
q->info.si_overrun++; q->info.si_overrun++;
goto out; goto out;
} }
q->info.si_overrun = 0;
signalfd_notify(t, sig); signalfd_notify(t, sig);
pending = group ? &t->signal->shared_pending : &t->pending; pending = group ? &t->signal->shared_pending : &t->pending;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment