2006-09-30 00:53:26

by Dong Feng

[permalink] [raw]
Subject: Race Condition over sys_tz

The operations on sys_tz, so far known to me in sys_settimeofday and
sys_gettimeofday, is neither atomic nor protected by any lock. I
suspect it probably causes unpredictable behavior when multiple
processes try to set the system time zone simultaneously.

Following is the code fragment extracted from do_sys_settimeofday().
The function is invoked by sys_settimeofday() without locking. At
least two non-atomic operations:

1. struct copy between *tz and sys_tz.
2. The test-and-operate over firsttime.

if (tz) {
/* SMP safe, global irq locking makes it work. */
sys_tz = *tz;
if (firsttime) {
firsttime = 0;
if (!tv)
warp_clock();
}
}