* Alexey Kuznetsov <[EMAIL PROTECTED]> wrote:
> Hello!
>
> 1. New entries can be added to tsk->pi_state_list after task completed
> exit_pi_state_list(). The result is memory leakage and deadlocks.
>
> 2. handle_mm_fault() is called under spinlock. The result is obvious.
>
> 3. State machine is broken. Kernel thinks it owns futex after
> it released all the locks. Ergo, it corrupts futex. The result is that
> two processes think they took a futex.
>
> All the bugs are trivially reproduced when running glibc's tst-robustpi7
> test long enough.
>
> The patch is not quite good (RFC!), because:
>
> 1. There is one case, when I did not figure out how to handle
> page fault correctly. I would do it releasing taken rtmutex
> and hb->lock and retrying futex from the very beginning.
> It is quite ugly. Probably, state machine can be fixed somehow.
>
> 2. Before this patch I had one unexplained oops inside rtmutex
> in plist_del. I did _not_ fix this, but it does not want to reproduce.
> Probably, more strong locking did some race window too narrow.
thanks for the fixes - they look all good and we'll check it in -rt.
We'll try to find a solution for the remaining problem too. Could your
#2 crash be explained via any of the bugs you fixed? (i.e. memory
corruption?) I'd exclude genuine rtmutex.c breakage for now because
that's the basis of all locking in -rt - but maybe the futex interfacing
upsets something ...
Ingo
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
