Skip to contentSkip to conversation

futex: PI state locking fix

PATCH In review Ingo Molnar 3 participants 4 messages Mar 12, 2007

lore
Share & tools
lore

Ingo Molnar

author
#0 lore raw

PATCH 1/1 futex: PI state locking fix

Subject: [patch] futex: PI state locking fix
From: Ingo Molnar <[email protected]>

testing of -rt by IBM uncovered a locking bug in wake_futex_pi(): the PI state needs to be locked before we access it.

this patch has been tested in -rt. Must-have for v2.6.21.

Signed-off-by Ingo Molnar <[email protected]>

--

 kernel/futex.c |    2 ++
 1 file changed, 2 insertions(+)
kernel/futex.c +2 -0
Index: linux/kernel/futex.c
===================================================================
@@ -566,6 +566,7 @@ static int wake_futex_pi(u32 __user *uad
 	if (!pi_state)
 		return -EINVAL;
 
+	spin_lock(&pi_state->pi_mutex.wait_lock);
 	new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
 
 	/*

@@ -605,6 +606,7 @@ static int wake_futex_pi(u32 __user *uad
 	pi_state->owner = new_owner;
 	spin_unlock_irq(&new_owner->pi_lock);
 
+	spin_unlock(&pi_state->pi_mutex.wait_lock);
 	rt_mutex_unlock(&pi_state->pi_mutex);
 
 	return 0;
Acked-by on v1 1/1
#1 lore raw
Quoted 9 lines · Ingo Molnar

Subject: [patch] futex: PI state locking fix
From: Ingo Molnar <[email protected]>

testing of -rt by IBM uncovered a locking bug in wake_futex_pi(): the PI state needs to be locked before we access it.

this patch has been tested in -rt. Must-have for v2.6.21.

Signed-off-by Ingo Molnar <[email protected]>
Acked-by Thomas Gleixner <[email protected]>
Quoted 24 lines

--

 kernel/futex.c |    2 ++
 1 file changed, 2 insertions(+)

Index: linux/kernel/futex.c
===================================================================

kernel/futex.c +2 -0
@@ -566,6 +566,7 @@ static int wake_futex_pi(u32 __user *uad
 	if (!pi_state)
 		return -EINVAL;
 
+	spin_lock(&pi_state->pi_mutex.wait_lock);
 	new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
 
 	/*

@@ -605,6 +606,7 @@ static int wake_futex_pi(u32 __user *uad
 	pi_state->owner = new_owner;
 	spin_unlock_irq(&new_owner->pi_lock);
 
+	spin_unlock(&pi_state->pi_mutex.wait_lock);
 	rt_mutex_unlock(&pi_state->pi_mutex);
 
 	return 0;
#2 lore raw
In reply to Ingo Molnar
Quoted 8 lines · Ingo Molnar

Subject: [patch] futex: PI state locking fix
From: Ingo Molnar <[email protected]>

testing of -rt by IBM uncovered a locking bug in wake_futex_pi(): the PI state needs to be locked before we access it.

this patch has been tested in -rt. Must-have for v2.6.21.

Does that fix this:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=224262

[<c043f3d7>] rt_mutex_next_owner+0x2f/0x40
    kernel/rt_mutex_common.c:rt_mutex_top_waiter():74:
        BUG_ON(w->lock != lock);
[<c043ecfc>] do_futex+0x94d/0xbe3
     inlined: futex_unlock_pi()
     inlined: wake_futex_pi()
     kernel/futex.c:wake_futex_pi():569:
        new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
[<c043f0af>] sys_futex+0x11d/0x130
[<c040404b>] syscall_call+0x7/0xb