Messages in this thread Patch in this message | | | Date | Thu, 27 Apr 2006 18:56:44 +0800 | From | Porpoise <> | Subject | When CONFIG_BASE_SAMLL=1, the kernel 2.6.16.11 (cascade() in kernel/timer.c) may enter the infinite loop. |
| |
Dear all,
I found a bug. When CONFIG_BASE_SAMLL=1, the kernel 2.6.16.11 (cascade() in kernel/timer.c) may enter the infinite loop. Because of CONFIG_BASE_SMALL=1(TVR_BITS=6 and TVN_BITS=4), the list base->tv5 may cascade into base->tv5. So, the kernel enters the infinite loop in the function cascade() . And I created a test module to verify this bug, and a patch file to fix it.
Regards, Porpoise
=== test module ================= #include <linux/kernel.h> #include <linux/module.h> #include <linux/init.h> #include <linux/timer.h> #if 0 #include <linux/kdb.h> #else #define kdb_printf printk #endif
#define TVN_BITS (CONFIG_BASE_SMALL ? 4 : 6) #define TVR_BITS (CONFIG_BASE_SMALL ? 6 : 8) #define TVN_SIZE (1 << TVN_BITS) #define TVR_SIZE (1 << TVR_BITS) #define TVN_MASK (TVN_SIZE - 1) #define TVR_MASK (TVR_SIZE - 1)
#define TV_SIZE(N) (N*TVN_BITS + TVR_BITS)
struct timer_list timer0; struct timer_list dummy_timer1; struct timer_list dummy_timer2;
void dummy_timer_fun(unsigned long data) { } unsigned long j=0; void check_timer_base(unsigned long data) { kdb_printf("check_timer_base %08x\n",jiffies); mod_timer(&timer0,(jiffies & (~0xFFF)) + 0x1FFF); }
int init_module(void) { init_timer(&timer0); timer0.data = (unsigned long)0; timer0.function = check_timer_base; mod_timer(&timer0,jiffies+1);
init_timer(&dummy_timer1); dummy_timer1.data = (unsigned long)0; dummy_timer1.function = dummy_timer_fun;
init_timer(&dummy_timer2); dummy_timer2.data = (unsigned long)0; dummy_timer2.function = dummy_timer_fun;
j=jiffies; j&=(~((1<<TV_SIZE(3))-1)); j+=(1<<TV_SIZE(3)); j+=(1<<TV_SIZE(4));
kdb_printf("mod_timer %08x\n",j);
mod_timer(&dummy_timer1, j ); mod_timer(&dummy_timer2, j );
return 0; }
void cleanup_module() { del_timer_sync(&timer0); del_timer_sync(&dummy_timer1); del_timer_sync(&dummy_timer2); }
=== patch file =================
--- linux-2.6.16.11/kernel/timer.c 2006-04-25 04:20:24.000000000 +0800 +++ linux-2.6.16.11mod/kernel/timer.c 2006-04-27 14:30:02.000000000 +0800 @@ -394,6 +394,34 @@ EXPORT_SYMBOL(del_timer_sync); #endif
+#ifdef CONFIG_BASE_SMALL +static int cascade_safe(tvec_base_t *base, tvec_t *tv, int index) +{ + /* cascade all the timers from tv up one level */ + struct list_head *head, *curr; + struct list_head dummy_head; + + head = tv->vec + index; + + list_add(&dummy_head,head); + list_del_init(head); + + curr = dummy_head.next; + while (curr != &dummy_head) { + struct timer_list *tmp; + + tmp = list_entry(curr, struct timer_list, entry); + BUG_ON(tmp->base != &base->t_base); + curr = curr->next; + internal_add_timer(base, tmp); + } + + return index; +} +#else +#define cascade_safe(base,tv,index) cascade(base,tv,index) +#endif + static int cascade(tvec_base_t *base, tvec_t *tv, int index) { /* cascade all the timers from tv up one level */ @@ -444,7 +472,7 @@ (!cascade(base, &base->tv2, INDEX(0))) && (!cascade(base, &base->tv3, INDEX(1))) && !cascade(base, &base->tv4, INDEX(2))) - cascade(base, &base->tv5, INDEX(3)); + cascade_safe(base, &base->tv5, INDEX(3)); ++base->timer_jiffies; list_splice_init(base->tv1.vec + index, &work_list); while (!list_empty(head)) { - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |