Re: [RFC][PATCH] muptiple bugs in PI futexes

[Ingo Molnar <mingo@elte.hu>]

* Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> wrote:

> Hello!
> 
> 1. New entries can be added to tsk->pi_state_list after task completed
>    exit_pi_state_list(). The result is memory leakage and deadlocks.
> 
> 2. handle_mm_fault() is called under spinlock. The result is obvious.
> 
> 3. State machine is broken. Kernel thinks it owns futex after
>    it released all the locks. Ergo, it corrupts futex. The result is that
>    two processes think they took a futex.
> 
> All the bugs are trivially reproduced when running glibc's tst-robustpi7
> test long enough.
> 
> The patch is not quite good (RFC!), because:
> 
> 1. There is one case, when I did not figure out how to handle
>    page fault correctly. I would do it releasing taken rtmutex
>    and hb->lock and retrying futex from the very beginning.
>    It is quite ugly. Probably, state machine can be fixed somehow.
> 
> 2. Before this patch I had one unexplained oops inside rtmutex
>    in plist_del. I did _not_ fix this, but it does not want to reproduce.
>    Probably, more strong locking did some race window too narrow.

thanks for the fixes - they look all good and we'll check it in -rt. 
We'll try to find a solution for the remaining problem too. Could your
#2 crash be explained via any of the bugs you fixed? (i.e. memory
corruption?) I'd exclude genuine rtmutex.c breakage for now because 
that's the basis of all locking in -rt - but maybe the futex interfacing 
upsets something ...

	Ingo