Date: Tue, 29 Jul 2003 10:41:35 -0500
From: linas@austin.ibm.com
To: linux-kernel@vger.kernel.org
Subject: PATCH: Race in 2.6.0-test2 timer code
Message-ID: <20030729104135.A48598@forte.austin.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 929
Lines: 35


PATCH: Race in 2.6.0-test2 timer code

Hi,

I have been chasing a pointer corruption bug in the timer code, and
found the following race in the mod_timer() routine.  I am still 
testing to see if this fixes my bug ... 

--linas


--- linux-2.6.0-test2/kernel/timer.c.orig	2003-07-27 12:07:34.000000000 -0500
+++ linux-2.6.0-test2/kernel/timer.c	2003-07-29 10:22:13.000000000 -0500
@@ -258,8 +258,13 @@ repeat:
 			spin_unlock(&old_base->lock);
 			goto repeat;
 		}
-	} else
+	} else {
 		spin_lock(&new_base->lock);
+		if (timer->base != old_base) {
+			spin_unlock(&new_base->lock);
+			goto repeat;
+		}
+	}
 
 	/*
 	 * Delete the previous timeout (if there was any), and install
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/