Skip to content

L
linux
Switch branch/tag
  1. 27 Jul, 2008 1 commit
  3. 23 Jul, 2008 2 commits
    • Oleg Nesterov's avatar
      posix-timers: fix posix_timer_event() vs dequeue_signal() race · ba661292
      Oleg Nesterov authored 
      The bug was reported and analysed by Mark McLoughlin <markmc@redhat.com>,
the patch is based on his and Roland's suggestions.

posix_timer_event() always rewrites the pre-allocated siginfo before sending
the signal. Most of the written info is the same all the time, but memset(0)
is very wrong. If ->sigq is queued we can race with collect_signal() which
can fail to find this siginfo looking at .si_signo, or copy_siginfo() can
copy the wrong .si_code/si_tid/etc.

In short, sys_timer_settime() can in fact stop the active timer, or the user
can receive the siginfo with the wrong .si_xxx values.

Move "memset(->info, 0)" from posix_timer_event() to alloc_posix_timer(),
change send_sigqueue() to set .si_overrun = 0 when ->sigq is not queued.
It would be nice to move the whole sigq->info initialization from send to
create path, but this is not easy to do without uglifying timer_create()
further.

As Roland rightly pointed out, we need more cleanups/fixes here, see the
"FIXME" comment in the patch. Hopefully this patch makes sense anyway, and
it can mask the most bad implications.
Reported-by: default avatarMark McLoughlin <markmc@redhat.com>
Signed-off-by: default avatarOleg Nesterov <oleg@tv-sign.ru>
Cc: Mark McLoughlin <markmc@redhat.com>
Cc: Oliver Pinter <oliver.pntr@gmail.com>
Cc: Roland McGrath <roland@redhat.com>
Cc: stable@kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>

 kernel/posix-timers.c |   17 +++++++++++++----
 kernel/signal.c       |    1 +
 2 files changed, 14 insertions(+), 4 deletions(-)
      ba661292
    • Oleg Nesterov's avatar
      posix-timers: do_schedule_next_timer: fix the setting of ->si_overrun · 54da1174
      Oleg Nesterov authored 
      do_schedule_next_timer() sets info->si_overrun = timr->it_overrun_last,
this discards the already accumulated overruns.
Signed-off-by: default avatarOleg Nesterov <oleg@tv-sign.ru>
Cc: Mark McLoughlin <markmc@redhat.com>
Cc: Oliver Pinter <oliver.pntr@gmail.com>
Cc: Roland McGrath <roland@redhat.com>
Cc: stable@kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      54da1174
  5. 19 Jul, 2008 1 commit
  7. 18 Jul, 2008 2 commits
    • Ingo Molnar's avatar
      Merge branch 'linus' into timers/nohz · 9b610fda
      Ingo Molnar authored
      9b610fda
    • Thomas Gleixner's avatar
      nohz: prevent tick stop outside of the idle loop · b8f8c3cf
      Thomas Gleixner authored 
      Jack Ren and Eric Miao tracked down the following long standing
problem in the NOHZ code:

	scheduler switch to idle task
	enable interrupts

Window starts here

	----> interrupt happens (does not set NEED_RESCHED)
	      	irq_exit() stops the tick

	----> interrupt happens (does set NEED_RESCHED)

	return from schedule()
	
	cpu_idle(): preempt_disable();

Window ends here

The interrupts can happen at any point inside the race window. The
first interrupt stops the tick, the second one causes the scheduler to
rerun and switch away from idle again and we end up with the tick
disabled.

The fact that it needs two interrupts where the first one does not set
NEED_RESCHED and the second one does made the bug obscure and extremly
hard to reproduce and analyse. Kudos to Jack and Eric.

Solution: Limit the NOHZ functionality to the idle loop to make sure
that we can not run into such a situation ever again.

cpu_idle()
{
	preempt_disable();

	while(1) {
		 tick_nohz_stop_sched_tick(1); <- tell NOHZ code that we
		 			          are in the idle loop

		 while (!need_resched())
		       halt();

		 tick_nohz_restart_sched_tick(); <- disables NOHZ mode
		 preempt_enable_no_resched();
		 schedule();
		 preempt_disable();
	}
}

In hindsight we should have done this forever, but ... 

/me grabs a large brown paperbag.

Debugged-by: Jack Ren <jack.ren@marvell.com>, 
Debugged-by: default avatareric miao <eric.y.miao@gmail.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      b8f8c3cf
  9. 17 Jul, 2008 32 commits
  11. 16 Jul, 2008 2 commits
    • Jesse Barnes's avatar
      Revert "x86/PCI: ACPI based PCI gap calculation" · 58b6e553
      Jesse Barnes authored 
      This reverts commit 809d9a8f.

This one isn't quite ready for prime time.  It needs more testing and
additional feedback from the ACPI guys.
      58b6e553
    • Coly Li's avatar
      [PATCH] ocfs2: fix oops in mmap_truncate testing · c0420ad2
      Coly Li authored 
      This patch fixes a mmap_truncate bug which was found by ocfs2 test suite.

In an ocfs2 cluster more than 1 node, run program mmap_truncate, which races
mmap writes and truncates from multiple processes. While the test is
running, a stat from another node forces writeout, causing an oops in
ocfs2_get_block() because it sees a buffer to write which isn't allocated.

This patch fixed the bug by clear dirty and uptodate bits in buffer, leave
the buffer unmapped and return.

Fix is suggested by Mark Fasheh, and I code up the patch.
Signed-off-by: default avatarColy Li <coyli@suse.de>
Signed-off-by: default avatarMark Fasheh <mfasheh@suse.com>
      c0420ad2
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7