Re: [PATCH] Re: [BUG] Race condition with it_real_fn in kernel/itimer.c

Steven Rostedt
2005-06-16T11:45:34Z

On Thu, 2005-06-16 at 07:33 -0400, Steven Rostedt wrote:

> int do_setitimer(int which, struct itimerval *value, struct itimerval *ovalue)
> {
> struct task_struct *tsk = current;
> static spinlock_t lock = SPIN_LOCK_UNLOCKED;
>
> [...]
> spin_lock(&lock);
> spin_unlock(&tsk->sighand->siglock);
> del_timer_sync(&tsk->signal->real_timer);
> spin_lock(&tsk->sighand->siglock);
> spin_unlock(&lock);

OK, I just got out of bed, so I'm not too with it :-)

This is pretty much a guaranteed deadlock! So the first spin_lock needs
to go before the siglock. That should do it!

case ITIMER_REAL:
spin_lock_irq(&lock);
spin_lock(&tsk->sighand->siglock);
[...]
spin_unlock(&tsk->sighand->siglock);
del_timer_sync(&tsk->signal->real_timer);
spin_lock(&tsk->sighand->siglock);
spin_unlock(&lock);

We just need to keep two do_setitimer calls from grabbing the siglock.
That first string of code didn't prevent that.

-- Steve