Re: [BUG] Null pointer deref with hrtimer_try_to_cancel()

[Oleg Nesterov <oleg@redhat.com>]

On 12/19, Thomas Gleixner wrote:
>
> On Fri, 19 Dec 2008, Eric Sesterhenn wrote:
>
> > I was running the strace-test from ltp 20081130 with 2.6.28-rc9, when i got the following bug
> > (I can reproduce the bug by simply running the testcase timer_create04)

Thanks a lot Eric (and thanks for .s files you sent me privately).

At first glance this all is very strange.

> > [ 2460.444044]  [<c0141070>] ? hrtimer_try_to_cancel+0x20/0x90
> > [ 2460.444044]  [<c013cf94>] ? exit_itimers+0x94/0xf0
> > [ 2460.444044]  [<c012cab2>] ? do_exit+0x602/0x810

So, when the task exits its has a timer in ->posix_timers.

However, this means sys_timer_create() must return 0, the code
is very simple

	spin_lock_irq(&current->sighand->siglock);
	new_timer->it_process = process;
	list_add(&new_timer->list, &current->signal->posix_timers);
	spin_unlock_irq(&current->sighand->siglock);

	return 0;

and nobody else adds the timer to ->posix_timers.

But,

> > root@computer-desktop:~/testing/ltp-full-20081130/tools/strace_test#
> > ./timer_create04
> > timer_create04    1  FAIL  :  timer_create(2) failed to produce expected
> > error; 22 , errno : EINVAL and got 0
> > timer_create04    2  PASS  :  timer_create(2) expected failure; Got
> > errno - EINVAL : Invalid parameter
> > timer_create04    3  PASS  :  timer_create(2) expected failure; Got
> > errno - EFAULT : Bad address
> > timer_create04    4  PASS  :  timer_create(2) expected failure; Got
> > errno - EFAULT : Bad address
> > timer_create04    5  PASS  :  timer_create(2) expected failure; Got
> > errno - EFAULT : Bad address
> > timer_create04    6  PASS  :  timer_create(2) expected failure; Got
> > errno - EFAULT : Bad address

according to above, timer_create() always returns -EXXX ?

I'll try to re-produce and investigate tomorrow.

Oleg.