Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 67a077dc authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'timers-fixes-for-linus' of... 

Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  posix-timers: fix posix_timer_event() vs dequeue_signal() race
  posix-timers: do_schedule_next_timer: fix the setting of ->si_overrun
parents 9b4d0bab 2106b531

kernel/posix-timers.c

+14 −5
Original line number Diff line number Diff line
@@ -289,7 +289,7 @@ void do_schedule_next_timer(struct siginfo *info) 
		else

			schedule_next_timer(timr);



		info->si_overrun = timr->it_overrun_last;

		info->si_overrun += timr->it_overrun_last;

	}



	if (timr)
@@ -298,12 +298,20 @@ void do_schedule_next_timer(struct siginfo *info) 


int posix_timer_event(struct k_itimer *timr, int si_private)

{

	memset(&timr->sigq->info, 0, sizeof(siginfo_t));

	/*

	 * FIXME: if ->sigq is queued we can race with

	 * dequeue_signal()->do_schedule_next_timer().

	 *

	 * If dequeue_signal() sees the "right" value of

	 * si_sys_private it calls do_schedule_next_timer().

	 * We re-queue ->sigq and drop ->it_lock().

	 * do_schedule_next_timer() locks the timer

	 * and re-schedules it while ->sigq is pending.

	 * Not really bad, but not that we want.

	 */

	timr->sigq->info.si_sys_private = si_private;

	/* Send signal to the process that owns this timer.*/



	timr->sigq->info.si_signo = timr->it_sigev_signo;

	timr->sigq->info.si_errno = 0;

	timr->sigq->info.si_code = SI_TIMER;

	timr->sigq->info.si_tid = timr->it_id;

	timr->sigq->info.si_value = timr->it_sigev_value;
@@ -435,6 +443,7 @@ static struct k_itimer * alloc_posix_timer(void) 
		kmem_cache_free(posix_timers_cache, tmr);

		tmr = NULL;

	}

	memset(&tmr->sigq->info, 0, sizeof(siginfo_t));

	return tmr;

}

kernel/signal.c

+1 −0
Original line number Diff line number Diff line
@@ -1304,6 +1304,7 @@ int send_sigqueue(struct sigqueue *q, struct task_struct *t, int group) 
		q->info.si_overrun++;

		goto out;

	}

	q->info.si_overrun = 0;



	signalfd_notify(t, sig);

	pending = group ? &t->signal->shared_pending : &t->pending;