lkml.org 
[lkml]   [2007]   [May]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC][PATCH] muptiple bugs in PI futexes

* Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> wrote:

> Hello!
>
> 1. New entries can be added to tsk->pi_state_list after task completed
> exit_pi_state_list(). The result is memory leakage and deadlocks.
>
> 2. handle_mm_fault() is called under spinlock. The result is obvious.
>
> 3. State machine is broken. Kernel thinks it owns futex after
> it released all the locks. Ergo, it corrupts futex. The result is that
> two processes think they took a futex.
>
> All the bugs are trivially reproduced when running glibc's tst-robustpi7
> test long enough.
>
> The patch is not quite good (RFC!), because:
>
> 1. There is one case, when I did not figure out how to handle
> page fault correctly. I would do it releasing taken rtmutex
> and hb->lock and retrying futex from the very beginning.
> It is quite ugly. Probably, state machine can be fixed somehow.
>
> 2. Before this patch I had one unexplained oops inside rtmutex
> in plist_del. I did _not_ fix this, but it does not want to reproduce.
> Probably, more strong locking did some race window too narrow.

thanks for the fixes - they look all good and we'll check it in -rt.
We'll try to find a solution for the remaining problem too. Could your
#2 crash be explained via any of the bugs you fixed? (i.e. memory
corruption?) I'd exclude genuine rtmutex.c breakage for now because
that's the basis of all locking in -rt - but maybe the futex interfacing
upsets something ...

Ingo
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2007-05-23 09:29    [W:0.147 / U:0.124 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site