linux/include
Alexey Kuznetsov 778e9a9c3e pi-futex: fix exit races and locking problems
1. New entries can be added to tsk->pi_state_list after task completed
   exit_pi_state_list(). The result is memory leakage and deadlocks.

2. handle_mm_fault() is called under spinlock. The result is obvious.

3. results in self-inflicted deadlock inside glibc.
   Sometimes futex_lock_pi returns -ESRCH, when it is not expected
   and glibc enters to for(;;) sleep() to simulate deadlock. This problem
   is quite obvious and I think the patch is right. Though it looks like
   each "if" in futex_lock_pi() got some stupid special case "else if". :-)

4. sometimes futex_lock_pi() returns -EDEADLK,
   when nobody has the lock. The reason is also obvious (see comment
   in the patch), but correct fix is far beyond my comprehension.
   I guess someone already saw this, the chunk:

                        if (rt_mutex_trylock(&q.pi_state->pi_mutex))
                                ret = 0;

   is obviously from the same opera. But it does not work, because the
   rtmutex is really taken at this point: wake_futex_pi() of previous
   owner reassigned it to us. My fix works. But it looks very stupid.
   I would think about removal of shift of ownership in wake_futex_pi()
   and making all the work in context of process taking lock.

From: Thomas Gleixner <tglx@linutronix.de>

Fix 1) Avoid the tasklist lock variant of the exit race fix by adding
    an additional state transition to the exit code.

    This fixes also the issue, when a task with recursive segfaults
    is not able to release the futexes.

Fix 2) Cleanup the lookup_pi_state() failure path and solve the -ESRCH
    problem finally.

Fix 3) Solve the fixup_pi_state_owner() problem which needs to do the fixup
    in the lock protected section by using the in_atomic userspace access
    functions.

    This removes also the ugly lock drop / unqueue inside of fixup_pi_state()

Fix 4) Fix a stale lock in the error path of futex_wake_pi()

Added some error checks for verification.

The -EDEADLK problem is solved by the rtmutex fixups.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ulrich Drepper <drepper@redhat.com>
Cc: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-06-08 17:23:34 -07:00
..
acpi Pull osi-now into release branch 2007-06-02 01:02:09 -04:00
asm-alpha ALPHA: misc fixes 2007-06-01 08:18:29 -07:00
asm-arm [ARM] 4421/1: AT91: Value of _KEY fields. 2007-06-03 17:52:35 +01:00
asm-arm26 [ARM] use __used attribute 2007-05-30 13:15:06 +01:00
asm-avr32 [AVR32] Implement platform hooks for atmel_lcdfb driver 2007-05-15 14:13:27 +02:00
asm-blackfin Blackfin arch: Change NO_ACCESS_CHECK to ACCESS_CHECK 2007-05-21 09:50:23 -07:00
asm-cris
asm-frv frv: build fix 2007-06-07 17:00:25 -07:00
asm-generic sparc64: fix alignment bug in linker definition script 2007-05-29 21:29:00 +02:00
asm-h8300 h8300 trival patches 2007-06-01 08:18:29 -07:00
asm-i386 i386: fix early usage of atomic_add_return and local_add_return on real i386 2007-05-23 20:14:15 -07:00
asm-ia64 [IA64] Cleanup acpi header to reuse the generic _PDC defines 2007-05-24 10:15:06 -07:00
asm-m32r m32r: __xchg() should be always_inline 2007-05-15 18:56:37 -07:00
asm-m68k m68k: discontinuous memory support 2007-05-31 07:58:14 -07:00
asm-m68knommu
asm-mips [MIPS] Drop __ARCH_WANT_SYS_FADVISE64 2007-06-06 19:34:32 +01:00
asm-parisc Detach sched.h from mm.h 2007-05-21 09:18:19 -07:00
asm-powerpc [POWERPC] Fix return from pte_alloc_one() in out-of-memory case 2007-06-02 21:01:56 +10:00
asm-ppc
asm-s390 [S390] Wire up signald, timerfd and eventfd syscalls. 2007-05-21 11:25:28 +02:00
asm-sh sh: Fix se73180 platform device registration. 2007-06-04 11:07:23 +09:00
asm-sh64 sh64: generic quicklist support. 2007-05-14 09:55:35 +09:00
asm-sparc [SPARC]: Emulate cmpxchg like parisc 2007-05-29 02:51:13 -07:00
asm-sparc64 [SPARC64]: Fill in gaps in non-PCI dma_*() NOP implementation. 2007-06-04 23:32:23 -07:00
asm-um
asm-v850
asm-x86_64 Detach sched.h from mm.h 2007-05-21 09:18:19 -07:00
asm-xtensa Xtensa: use asm-generic/fcntl.h 2007-05-31 20:18:25 -07:00
crypto
keys
linux pi-futex: fix exit races and locking problems 2007-06-08 17:23:34 -07:00
math-emu
media
mtd
net xfrm: Add security check before flushing SAD/SPD 2007-06-07 13:42:46 -07:00
pcmcia
rdma Merge branch 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband 2007-05-21 16:19:32 -07:00
rxrpc
scsi
sound [ALSA] version 1.0.14 2007-05-31 11:03:27 +02:00
video
Kbuild