Re: PATCH: Race in 2.6.0-test2 timer code

[Andrew Morton <akpm@osdl.org>]

Ingo Molnar <mingo@elte.hu> wrote:
>
> But on 2.6 the timer will run precisely on the CPU it was added, so i
>  think the race is not possible.

well there is add_timer_on()...

I still don't see the race in the itimer code actually.  On return
from del_timer_sync() we know that the timer is not pending, even
if it_real_fn() tried to re-add it.

ie: why does the below "crash"?


Andrea Arcangeli <andrea@suse.de> wrote:
>
> 	cpu0			cpu1
>  	------------		--------------------
> 
>  	do_setitimer
>  				it_real_fn
>  	del_timer_sync		add_timer	-> crash


(Does the timer_pending() test in del_timer_sync() needs some
barriers btw?)