rw_semaphore bug

rw_semaphore bug

[David Howells]

[-- Attachment #1: Type: text/plain, Size: 415 bytes --]

I've found a bug in the write path of the read/write semaphore stuff (at least
for the i386 arch). The attached kernel module (rwsem.c) and driver program
(driver.c) demonstrate it.

What happens is that once the driver finishes, you end up with a whole load of
processes forked off of driver that are stuck in the D state and are waiting
in down_write_failed(), even though the semaphore is in the unlocked state.

[-- Attachment #2: rwsem.c --]
[-- Type: text/plain, Size: 1594 bytes --]

#define __NO_VERSION__
#include <linux/config.h>
#include <linux/module.h>
#include <linux/poll.h>
#include <linux/proc_fs.h>
#include <linux/stat.h>
#include <linux/init.h>
#include <linux/personality.h>
#include <linux/smp_lock.h>
#include <linux/delay.h>

struct proc_dir_entry *rwsem_proc;

struct rw_semaphore rwsem_sem;

static int rwsem_write_proc(struct file *file, const char *buffer, unsigned long count, void *data)
{
	printk("[%05d %08x]: downing\n",current->pid,rwsem_sem.count);
	down_write(&rwsem_sem);
	printk("[%05d %08x]: downed\n",current->pid,rwsem_sem.count);
	mdelay(1);
	printk("[%05d %08x]: upping\n",current->pid,rwsem_sem.count);
	up_write(&rwsem_sem);
	printk("[%05d %08x]: upped\n",current->pid,rwsem_sem.count);

	mdelay(100);

	printk("[%05d %08x]: downing\n",current->pid,rwsem_sem.count);
	down_write(&rwsem_sem);
	printk("[%05d %08x]: downed\n",current->pid,rwsem_sem.count);
	mdelay(1);
	printk("[%05d %08x]: upping\n",current->pid,rwsem_sem.count);
	up_write(&rwsem_sem);
	printk("[%05d %08x]: upped\n",current->pid,rwsem_sem.count);

	return -ENOENT;
}

static int __init rwsem_init_module(void)
{
	printk(KERN_INFO "rwsem loading...\n");

	init_rwsem(&rwsem_sem);

	/* try and create the access point */
	rwsem_proc = create_proc_entry("rwsem",S_IRUGO|S_IWUGO,NULL);
	if (!rwsem_proc)
		return -EEXIST;

	rwsem_proc->write_proc = &rwsem_write_proc;
	return 0;
}

static void __exit rwsem_cleanup_module(void)
{
	printk(KERN_INFO "rwsem unloading\n");

	remove_proc_entry("rwsem",NULL);

}

module_init(rwsem_init_module);
module_exit(rwsem_cleanup_module);

[-- Attachment #3: driver.c --]
[-- Type: text/plain, Size: 512 bytes --]

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>
#include <fcntl.h>

int main(int argc, char *argv[])
{
	int loop, fd, tmp;

	fd = open("/proc/rwsem",O_RDWR);
	if (fd<0) {
		perror("open");
		return 1;
	}

	for (loop=0; loop<50; loop++) {
		switch (fork()) {
		case -1:
			perror("fork");
			return 1;
		case 0:
			write(fd," ",1);
			exit(1);
		default:
			break;
		}
	}

	for (loop=0; loop<5; loop++) {
		if (wait(&tmp)<0) {
			perror("wait");
			return 1;
		}
	}

	return 0;
}