Thomas Gleixner
cdf71a10c7
futex: Prevent stale futex owner when interrupted/timeout ...
Roland Westrelin did a great analysis of a long standing thinko in the
return path of futex_lock_pi.
While we fixed the lock steal case long ago, which was easy to trigger,
we never had a test case which exposed this problem and stupidly never
thought about the reverse lock stealing scenario and the return to user
space with a stale state.
When a blocked tasks returns from rt_mutex_timed_locked without holding
the rt_mutex (due to a signal or timeout) and at the same time the task
holding the futex is releasing the futex and assigning the ownership of
the futex to the returning task, then it might happen that a third task
acquires the rt_mutex before the final rt_mutex_trylock() of the
returning task happens under the futex hash bucket lock. The returning
task returns to user space with ETIMEOUT or EINTR, but the user space
futex value is assigned to this task. The task which acquired the
rt_mutex fixes the user space futex value right after the hash bucket
lock has been released by the returning task, but for a short period of
time the user space value is wrong.
Detailed description is available at:
https://bugzilla.redhat.com/show_bug.cgi?id=400541
The fix for this is the same as we do when the rt_mutex was acquired by
a higher priority task via lock stealing from the designated new owner.
In that case we already fix the user space value and the internal
pi_state up before we return. This mechanism can be used to fixup the
above corner case as well. When the returning task, which failed to
acquire the rt_mutex, notices that it is the designated owner of the
futex, then it fixes up the stale user space value and the pi_state,
before returning to user space. This happens with the futex hash bucket
lock held, so the task which acquired the rt_mutex is guaranteed to be
blocked on the hash bucket lock. We can access the rt_mutex owner, which
gives us the pid of the new owner, safely here as the owner is not able
to modify (release) it while waiting on the hash bucket lock.
Rename the "curr" argument of fixup_pi_state_owner() to "newowner" to
avoid confusion with current and add the check for the stale state into
the failure path of rt_mutex_trylock() in the return path of
unlock_futex_pi(). If the situation is detected use
fixup_pi_state_owner() to assign everything to the owner of the
rt_mutex.
Pointed-out-and-tested-by: Roland Westrelin <roland.westrelin@sun.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-01-08 16:21:39 -08:00
genirq: revert lazy irq disable for simple irqs
2007-12-18 18:05:58 +01:00
hibernate: fix lockdep report
2007-11-14 18:45:43 -08:00
clockevents: fix reprogramming decision in oneshot broadcast
2007-12-18 18:05:58 +01:00
gitignore: ignore more generated files
2006-01-03 11:35:26 +01:00
acct: real_parent ppid
2008-01-07 14:55:37 -08:00
[PATCH] audit: watching subtrees
2007-10-21 02:37:45 -04:00
[PATCH] audit: watching subtrees
2007-10-21 02:37:45 -04:00
[PATCH] audit: watching subtrees
2007-10-21 02:37:45 -04:00
[PATCH] audit: watching subtrees
2007-10-21 02:37:45 -04:00
auditsc: fix kernel-doc param warnings
2007-10-22 19:40:02 -07:00
Uninline find_pid etc set of functions
2007-10-19 11:53:41 -07:00
Improve cgroup printks
2007-11-14 18:45:37 -08:00
Task Control Groups: simple task cgroup debug info subsystem
2007-10-19 11:53:36 -07:00
Merge ssh://master.kernel.org/pub/scm/linux/kernel/git/tglx/linux-2.6-hrt
2007-10-18 15:12:41 -07:00
use simple_read_from_buffer in kernel/
2007-05-09 12:30:49 -07:00
CPU HOTPLUG: avoid hotadd when proper possible_map isn't specified
2007-10-19 11:53:44 -07:00
hotplug cpu: migrate a task within its cpuset
2007-10-19 11:53:44 -07:00
Add scaled time to taskstats based process accounting
2007-10-18 14:37:28 -07:00
whitespace fixes: DMA channel allocator
2007-10-18 14:37:24 -07:00
whitespace fixes: execution domains
2007-10-18 14:37:26 -07:00
wait_task_stopped(): pass correct exit_code to wait_noreap_copyout()
2007-11-29 09:24:55 -08:00
[PATCH] symbol_put_addr() locks kernel
2006-05-15 11:20:55 -07:00
fix clone(CLONE_NEWPID)
2007-12-05 09:21:18 -08:00
futex: Prevent stale futex owner when interrupted/timeout
2008-01-08 16:21:39 -08:00
[FUTEX] Fix address computation in compat code.
2007-11-09 16:13:08 -08:00
hrtimers: avoid overflow for large relative timeouts
2007-12-07 19:16:17 +01:00
whitespace fixes: interval timers
2007-10-18 14:37:26 -07:00
FRV: fix the extern declaration of kallsyms_num_syms
2007-11-29 09:24:54 -08:00
[PATCH] HZ: 300Hz support
2006-12-07 08:39:36 -08:00
Tiny clean-up of OPROFILE/KPROBES configuration
2007-12-06 09:41:12 -08:00
Move PREEMPT_NOTIFIERS into an always-included Kconfig
2007-10-17 08:42:55 -07:00
vmcoreinfo: add the array length of "free_list" for filtering free pages
2008-01-08 16:10:36 -08:00
is_power_of_2: kernel/kfifo.c
2007-07-16 09:05:50 -07:00
Restore call_usermodehelper_pipe() behaviour
2007-09-11 17:21:20 -07:00
kprobes: support kretprobe blacklist
2007-10-16 09:43:10 -07:00
add-vmcore: cleanup the coding style according to Andrew's comments
2007-10-17 08:42:54 -07:00
kthread: silence bogus section mismatch warning
2007-07-31 15:39:42 -07:00
[PATCH] severing module.h->sched.h
2006-12-04 02:00:22 -05:00
lockdep: make cli/sti annotation warnings clearer
2007-12-07 19:02:47 +01:00
[PATCH] lockdep: more chains
2006-12-07 08:39:43 -08:00
lockdep: Avoid /proc/lockdep & lock_stat infinite output
2007-10-11 22:11:11 +02:00
revert "Task Control Groups: example CPU accounting subsystem"
2007-11-14 18:45:40 -08:00
Linux Kernel Markers: fix marker mutex not taken upon module load
2007-11-14 18:45:40 -08:00
module: fix and elaborate comments
2007-11-19 11:20:43 +11:00
[PATCH] remove many unneeded #includes of sched.h
2007-02-14 08:09:54 -08:00
[PATCH] lockdep: better lock debugging
2006-07-03 15:27:01 -07:00
lockdep: fixup mutex annotations
2007-10-11 22:11:12 +02:00
[PATCH] lockdep: prove mutex locking correctness
2006-07-03 15:27:04 -07:00
Add kernel/notifier.c
2007-10-19 11:53:34 -07:00
cgroups: implement namespace tracking subsystem
2007-10-19 11:53:37 -07:00
pid namespaces: allow cloning of new namespace
2007-10-19 11:53:39 -07:00
debug: add end-of-oops marker
2007-12-20 15:01:17 +01:00
Modules: fix memory leak of module names
2007-12-22 23:09:05 -08:00
pidns: Place under CONFIG_EXPERIMENTAL
2007-11-14 18:45:43 -08:00
Isolate some explicit usage of task->tgid
2007-10-19 11:53:40 -07:00
Isolate some explicit usage of task->tgid
2007-10-19 11:53:40 -07:00
[SERIAL]: Fix section mismatches in Sun serial console drivers.
2007-12-29 01:19:49 -08:00
sched: document profile=sleep requiring CONFIG_SCHEDSTATS
2007-10-24 18:23:50 +02:00
Fix kernel/ptrace.c compile problem (missing "may_attach()")
2008-01-02 13:48:27 -08:00
Clean up duplicate includes in kernel/
2007-10-17 08:42:48 -07:00
Make rcutorture RNG use temporal entropy
2007-10-17 08:42:53 -07:00
whitespace fixes: relayfs
2007-10-18 14:37:24 -07:00
Add IORESOUCE_BUSY flag for System RAM
2007-11-14 18:45:39 -08:00
Use helpers to obtain task pid in printks
2007-10-19 11:53:43 -07:00
[PATCH] lockdep: better lock debugging
2006-07-03 15:27:01 -07:00
Freezer: make kernel threads nonfreezable by default
2007-07-17 10:23:02 -07:00
Use helpers to obtain task pid in printks
2007-10-19 11:53:43 -07:00
[PATCH] lockdep: better lock debugging
2006-07-03 15:27:01 -07:00
FUTEX: Tidy up the code
2007-07-16 09:05:49 -07:00
sched: mark rwsem functions as __sched for wchan/profiling
2007-12-18 15:21:13 +01:00
sched: touch softlockup watchdog after idling
2007-12-18 15:21:13 +01:00
sched: fix gcc warnings
2007-12-30 17:24:35 +01:00
sched: do not hurt SCHED_BATCH on wakeup
2007-12-18 15:21:13 +01:00
sched: isolate SMP balancing code a bit more
2007-10-24 18:23:51 +02:00
sched: rt: account the cpu time during the tick
2007-12-20 15:01:17 +01:00
sched: clean up kernel/sched_stat.h
2007-11-28 15:52:56 +01:00
make seccomp zerocost in schedule
2007-07-16 09:05:50 -07:00
sigwait eats blocked default-ignore signals
2007-11-12 16:05:23 -08:00
[KERNEL]: Unexport raise_softirq_irqoff
2007-10-10 16:49:18 -07:00
Use helpers to obtain task pid in printks
2007-10-19 11:53:43 -07:00
lockstat: hook into spinlock_t, rwlock_t, rwsem and mutex
2007-07-19 10:04:49 -07:00
[PATCH] SRCU: report out-of-memory errors
2006-10-04 07:55:30 -07:00
[PATCH] lockdep: stacktrace subsystem, core
2006-07-03 15:27:02 -07:00
Fix stop_machine_run problem with naughty real time process
2007-07-16 09:05:41 -07:00
x86: ignore the sys_getcpu() tcache parameter
2007-11-17 16:27:00 +01:00
[COMPAT]: Fix build on COMPAT platforms when CONFIG_NET is disabled.
2007-10-30 21:29:56 -07:00
sched: sysctl, proc_dointvec_minmax() expects int values for
2007-12-18 15:21:13 +01:00
sysctl: fix ax25 checks
2007-12-17 19:28:17 -08:00
kernel/taskstats.c: fix bogus nlmsg_free()
2007-11-14 18:45:44 -08:00
whitespace fixes: time syscalls
2007-10-18 14:37:24 -07:00
timer: kernel/timer.c section fixes
2007-12-18 18:05:58 +01:00
Add scaled time to taskstats based process accounting
2007-10-18 14:37:28 -07:00
header cleaning: don't include smp_lock.h when not used
2007-05-08 11:15:07 -07:00
sched: don't forget to unlock uids_mutex on error paths
2007-11-26 21:21:49 +01:00
Fix user namespace exiting OOPs
2007-09-19 11:24:18 -07:00
Fix UTS corruption during clone(CLONE_NEWUTS)
2007-09-19 11:24:17 -07:00
Isolate the UTS namespace's domainname and hostname back
2007-11-29 09:24:53 -08:00
Fix occurrences of "the the "
2007-05-09 08:57:56 +02:00
Use helpers to obtain task pid in printks
2007-10-19 11:53:43 -07:00
cdf71a10c7