On Sun, 13 Mar 2005, Oleg Nesterov wrote:

> I suspect that del_timer_sync() in its current form is racy.
>
> CPU 0                                         CPU 1
>
> __run_timers() sets timer->base = NULL
>
>                                               del_timer_sync() starts, calls 
> del_timer(), it returns
>                                               because timer->base == NULL.
>
>                                               waits until the run is complete:
>                                                       while 
> (base->running_timer == timer)
>                                                               
> preempt_check_resched();
>
>                                               calls schedule(), or long 
> interrupt happens.
>
> timer reschedules itself, __run_timers()
> exits.
>
>                                               base->running_timer == NULL, 
> end of loop.
>
> next timer interrupt, __run_timers() picks
> this timer again, sets timer->base = NULL
>
>                                               if (timer_pending(timer))       
> // no, timer->base == NULL

timer->base is != NULL because the timer has rescheduled itself.
__mod_timer sets timer->bBase

>                                                       goto del_again;         
> // not taken

Yes it is taken!

>
>                                               del_timer_sync() returns
>
> timer runs.

Nope.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Reply via email to