29 Nov, 2005

1 commit


07 Nov, 2005

1 commit


31 Oct, 2005

1 commit


28 Oct, 2005

2 commits


27 Oct, 2005

2 commits


24 Oct, 2005

5 commits

  • This might be harmless, but looks like a race from code inspection (I
    was unable to trigger it). I must admit, I don't understand why we
    can't return TIMER_RETRY after 'spin_unlock(&p->sighand->siglock)'
    without doing bump_cpu_timer(), but this is what original code does.

    posix_cpu_timer_set:

    read_lock(&tasklist_lock);

    spin_lock(&p->sighand->siglock);
    list_del_init(&timer->it.cpu.entry);
    spin_unlock(&p->sighand->siglock);

    We are probaly deleting the timer from run_posix_cpu_timers's 'firing'
    local list_head while run_posix_cpu_timers() does list_for_each_safe.

    Various bad things can happen, for example we can just delete this timer
    so that list_for_each() will not notice it and run_posix_cpu_timers()
    will not reset '->firing' flag. In that case,

    ....

    if (timer->it.cpu.firing) {
    read_unlock(&tasklist_lock);
    timer->it.cpu.firing = -1;
    return TIMER_RETRY;
    }

    sys_timer_settime() goes to 'retry:', calls posix_cpu_timer_set() again,
    it returns TIMER_RETRY ...

    Signed-off-by: Oleg Nesterov
    Signed-off-by: Linus Torvalds

    Oleg Nesterov
     
  • No need to rebalance when task exited

    Signed-off-by: Oleg Nesterov
    Signed-off-by: Linus Torvalds

    Oleg Nesterov
     
  • do_exit() clears ->it_##clock##_expires, but nothing prevents
    another cpu to attach the timer to exiting process after that.

    After exit_notify() does 'write_unlock_irq(&tasklist_lock)' and
    before do_exit() calls 'schedule() local timer interrupt can find
    tsk->exit_state != 0. If that state was EXIT_DEAD (or another cpu
    does sys_wait4) interrupted task has ->signal == NULL.

    At this moment exiting task has no pending cpu timers, they were cleaned
    up in __exit_signal()->posix_cpu_timers_exit{,_group}(), so we can just
    return from irq.

    Signed-off-by: Oleg Nesterov
    Signed-off-by: Linus Torvalds

    Oleg Nesterov
     
  • 1. cleanup_timers() sets timer->task = NULL under tasklist + ->sighand locks.
    That means that this code in posix_cpu_timer_del() and posix_cpu_timer_set()

    lock_timer(timer);
    if (timer->task == NULL)
    return;
    read_lock(tasklist);
    put_task_struct(timer->task)

    is racy. With this patch timer->task modified and accounted only under
    timer->it_lock. Sadly, this means that dead task_struct won't be freed
    until timer deleted or armed.

    2. run_posix_cpu_timers() collects expired timers into local list under
    tasklist + ->sighand again. That means that posix_cpu_timer_del()
    should check timer->it.cpu.firing under these locks too.

    Signed-off-by: Oleg Nesterov
    Signed-off-by: Linus Torvalds

    Oleg Nesterov
     
  • Bursty timers aren't good for anybody, very much including latency for
    other programs when we trigger lots of timers in interrupt context. So
    set a random limit, after which we'll handle the rest on the next timer
    tick.

    Noted by Oleg Nesterov

    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

22 Oct, 2005

1 commit


20 Oct, 2005

1 commit

  • Oleg Nesterov reported an SMP deadlock. If there is a running timer
    tracking a different process's CPU time clock when the process owning
    the timer exits, we deadlock on tasklist_lock in posix_cpu_timer_del via
    exit_itimers.

    That code was using tasklist_lock to check for a race with __exit_signal
    being called on the timer-target task and clearing its ->signal.
    However, there is actually no such race. __exit_signal will have called
    posix_cpu_timers_exit and posix_cpu_timers_exit_group before it does
    that. Those will clear those k_itimer's association with the dying
    task, so posix_cpu_timer_del will return early and never reach the code
    in question.

    In addition, posix_cpu_timer_del called from exit_itimers during execve
    or directly from timer_delete in the process owning the timer can race
    with an exiting timer-target task to cause a double put on timer-target
    task struct. Make sure we always access cpu_timers lists with sighand
    lock held.

    Signed-off-by: Roland McGrath
    Signed-off-by: Chris Wright
    Signed-off-by: Linus Torvalds

    Roland McGrath
     

18 Oct, 2005

1 commit


17 Apr, 2005

1 commit

  • Initial git repository build. I'm not bothering with the full history,
    even though we have it. We can create a separate "historical" git
    archive of that later if we want to, and in the meantime it's about
    3.2GB when imported into git - space that would just make the early
    git days unnecessarily complicated, when we don't have a lot of good
    infrastructure for it.

    Let it rip!

    Linus Torvalds