[patch] futex: PI state locking fix

[patch] futex: PI state locking fix

[Ingo Molnar]

Subject: [patch] futex: PI state locking fix
From: Ingo Molnar <mingo@elte.hu>

testing of -rt by IBM uncovered a locking bug in wake_futex_pi(): the PI 
state needs to be locked before we access it.

this patch has been tested in -rt. Must-have for v2.6.21.

Signed-off-by: Ingo Molnar <mingo@elte.hu>
--
 kernel/futex.c |    2 ++
 1 file changed, 2 insertions(+)

Index: linux/kernel/futex.c
===================================================================
--- linux.orig/kernel/futex.c
+++ linux/kernel/futex.c
@@ -566,6 +566,7 @@ static int wake_futex_pi(u32 __user *uad
 	if (!pi_state)
 		return -EINVAL;
 
+	spin_lock(&pi_state->pi_mutex.wait_lock);
 	new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
 
 	/*
@@ -605,6 +606,7 @@ static int wake_futex_pi(u32 __user *uad
 	pi_state->owner = new_owner;
 	spin_unlock_irq(&new_owner->pi_lock);
 
+	spin_unlock(&pi_state->pi_mutex.wait_lock);
 	rt_mutex_unlock(&pi_state->pi_mutex);
 
 	return 0;

Re: [patch] futex: PI state locking fix

[Thomas Gleixner]

On Mon, 2007-03-12 at 10:13 +0100, Ingo Molnar wrote:
> Subject: [patch] futex: PI state locking fix
> From: Ingo Molnar <mingo@elte.hu>
> 
> testing of -rt by IBM uncovered a locking bug in wake_futex_pi(): the PI 
> state needs to be locked before we access it.
> 
> this patch has been tested in -rt. Must-have for v2.6.21.
> 
> Signed-off-by: Ingo Molnar <mingo@elte.hu>

Acked-by: Thomas Gleixner <tglx@linutronix.de>

> --
>  kernel/futex.c |    2 ++
>  1 file changed, 2 insertions(+)
> 
> Index: linux/kernel/futex.c
> ===================================================================
> --- linux.orig/kernel/futex.c
> +++ linux/kernel/futex.c
> @@ -566,6 +566,7 @@ static int wake_futex_pi(u32 __user *uad
>  	if (!pi_state)
>  		return -EINVAL;
>  
> +	spin_lock(&pi_state->pi_mutex.wait_lock);
>  	new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
>  
>  	/*
> @@ -605,6 +606,7 @@ static int wake_futex_pi(u32 __user *uad
>  	pi_state->owner = new_owner;
>  	spin_unlock_irq(&new_owner->pi_lock);
>  
> +	spin_unlock(&pi_state->pi_mutex.wait_lock);
>  	rt_mutex_unlock(&pi_state->pi_mutex);
>  
>  	return 0;

Re: [patch] futex: PI state locking fix

[Chuck Ebbert]

Ingo Molnar wrote:
> Subject: [patch] futex: PI state locking fix
> From: Ingo Molnar <mingo@elte.hu>
> 
> testing of -rt by IBM uncovered a locking bug in wake_futex_pi(): the PI 
> state needs to be locked before we access it.
> 
> this patch has been tested in -rt. Must-have for v2.6.21.
> 

Does that fix this:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=224262

[<c043f3d7>] rt_mutex_next_owner+0x2f/0x40
    kernel/rt_mutex_common.c:rt_mutex_top_waiter():74:
        BUG_ON(w->lock != lock);
[<c043ecfc>] do_futex+0x94d/0xbe3
     inlined: futex_unlock_pi()
     inlined: wake_futex_pi()
     kernel/futex.c:wake_futex_pi():569:
        new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
[<c043f0af>] sys_futex+0x11d/0x130
[<c040404b>] syscall_call+0x7/0xb

Re: [patch] futex: PI state locking fix

[Ingo Molnar]

* Chuck Ebbert <cebbert@redhat.com> wrote:

> > this patch has been tested in -rt. Must-have for v2.6.21.
> 
> Does that fix this:
> 
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=224262

yeah, could very much be related.

	Ingo