On Fri, Mar 11, 2011 at 02:50:23PM +0100, Oleg Nesterov wrote:
> > @@ -218,10 +266,12 @@ SYSCALL_DEFINE4(timerfd_settime, int, uf
> >      * it to the new values.
> >      */
> >     for (;;) {
> > +           spin_lock(&notifiers_lock);
> >             spin_lock_irq(&ctx->wqh.lock);
> > -           if (hrtimer_try_to_cancel(&ctx->tmr) >= 0)
> > +           if (!list_empty(&notifiers_list) || 
> > hrtimer_try_to_cancel(&ctx->tmr) >= 0)
> >                     break;
> 
> Confused. Why do we check the global notifiers_list?

You're right, it's a bug, should be &ctx->notifiers_list.

> IOW. Suppose that this list is not empty and timerfd_settime() is called
> without TFD_NOTIFY_CLOCK_SET. Now we are going to reprogramm the timer
> without stopping it?
> 
> And. What if timerfd_settime(TFD_NOTIFY_CLOCK_SET, utmr => NULL) is called
> twice? timerfd_setup() blindly does list_add(), and we corrupt the list, no?

Another catch.

There will be a quite a bit of rework required, though, considering tglx's
comments.

Thanks!
--
Alex
--
To unsubscribe from this list: send the line "unsubscribe linux-api" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to