Potential timer bug

[Tipp Moseley <tipp.moseley@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1338 bytes --]

Hello,

I am running on a uniprocessor x86 with CONFIG_SMP disabled and
CONFIG_PREEMPT enabled.

The problem I have encountered is when using a timer in a module.  The
timer is set to execute every 3 ticks, and does nothing but increment
a counter, and that works fine.  However, when the module is unloaded
sometimes the system hangs on module exit and barfs something like:

Unable to handle kernel paging request at virtual address e18861bc
 printing eip:
c0122a88
*pde = 015e5067
*pte = 00000000
Oops: 0002 [#1]
PREEMPT
Modules linked in: yenta socket, rsrc_nonstatic sonypi
CPU: 0
...
Call Trace:
 __do_softirq+0x76/0x90
 do_softirq+0x41/0x50
...
<0>Kernel panic - not syncing: Fatal exception in interrupt


I am using del_timer_sync to delete the timer in the module_exit
routine, and sometimes it works correctly.  My theory is that since
with CONFIG_SMP disabled, del_timer_sync is the same as del_timer. 
This allows the timer to potentially execute after the module has
unloaded, causing the invalid paging request.

My solution to the problem (which works, but is probably not optimal)
is to change '#ifdef CONFIG_SMP' to '#if defined(CONFIG_SMP) ||
defined(CONFIG_PREEMPT)' around the code defining timer_del_sync.  A
patch is attached.  Let me know if there's any more information that I
can provide.

Thanks,

Tipp Moseley

[-- Attachment #2: linux-2.6.11-rc3-bk7-timer --]
[-- Type: application/octet-stream, Size: 1034 bytes --]

diff -urN linux-2.6.11-rc3-bk7/include/linux/timer.h linux-2.6.11-rc3-bk7-patched/include/linux/timer.h
--- linux-2.6.11-rc3-bk7/include/linux/timer.h	2004-12-24 14:35:23.000000000 -0700
+++ linux-2.6.11-rc3-bk7-patched/include/linux/timer.h	2005-02-11 01:16:39.000000000 -0700
@@ -87,7 +87,7 @@
 	__mod_timer(timer, timer->expires);
 }
 
-#ifdef CONFIG_SMP
+#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT)
   extern int del_timer_sync(struct timer_list *timer);
   extern int del_singleshot_timer_sync(struct timer_list *timer);
 #else
diff -urN linux-2.6.11-rc3-bk7/kernel/timer.c linux-2.6.11-rc3-bk7-patched/kernel/timer.c
--- linux-2.6.11-rc3-bk7/kernel/timer.c	2005-02-11 01:09:38.000000000 -0700
+++ linux-2.6.11-rc3-bk7-patched/kernel/timer.c	2005-02-11 01:16:53.000000000 -0700
@@ -318,7 +318,7 @@
 
 EXPORT_SYMBOL(del_timer);
 
-#ifdef CONFIG_SMP
+#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT)
 /***
  * del_timer_sync - deactivate a timer and wait for the handler to finish.
  * @timer: the timer to be deactivated