linux-toradex.git/kernel/exit.c, branch v2.6.20.21

[PATCH] pi-futex: Fix exit races and locking problems

2007-08-15T08:02:26+00:00

1. New entries can be added to tsk->pi_state_list after task completed
   exit_pi_state_list(). The result is memory leakage and deadlocks.

2. handle_mm_fault() is called under spinlock. The result is obvious.

3. results in self-inflicted deadlock inside glibc.
   Sometimes futex_lock_pi returns -ESRCH, when it is not expected
   and glibc enters to for(;;) sleep() to simulate deadlock. This problem
   is quite obvious and I think the patch is right. Though it looks like
   each "if" in futex_lock_pi() got some stupid special case "else if". :-)

4. sometimes futex_lock_pi() returns -EDEADLK,
   when nobody has the lock. The reason is also obvious (see comment
   in the patch), but correct fix is far beyond my comprehension.
   I guess someone already saw this, the chunk:

                        if (rt_mutex_trylock(&q.pi_state->pi_mutex))
                                ret = 0;

   is obviously from the same opera. But it does not work, because the
   rtmutex is really taken at this point: wake_futex_pi() of previous
   owner reassigned it to us. My fix works. But it looks very stupid.
   I would think about removal of shift of ownership in wake_futex_pi()
   and making all the work in context of process taking lock.

From: Thomas Gleixner 

Fix 1) Avoid the tasklist lock variant of the exit race fix by adding
    an additional state transition to the exit code.

    This fixes also the issue, when a task with recursive segfaults
    is not able to release the futexes.

Fix 2) Cleanup the lookup_pi_state() failure path and solve the -ESRCH
    problem finally.

Fix 3) Solve the fixup_pi_state_owner() problem which needs to do the fixup
    in the lock protected section by using the in_atomic userspace access
    functions.

    This removes also the ugly lock drop / unqueue inside of fixup_pi_state()

Fix 4) Fix a stale lock in the error path of futex_wake_pi()

Added some error checks for verification.

The -EDEADLK problem is solved by the rtmutex fixups.

Cc: Alexey Kuznetsov 
Signed-off-by: Thomas Gleixner 
Acked-by: Ingo Molnar 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] namespaces: fix task exit disaster

2007-01-30T21:40:36+00:00

This is based on a patch by Eric W.  Biederman, who pointed out that pid
namespaces are still fake, and we only have one ever active.

So for the time being, we can modify any code which could access
tsk->nsproxy->pid_ns during task exit to just use &init_pid_ns instead,
and move the exit_task_namespaces call in do_exit() back above
exit_notify(), so that an exiting nfs server has a valid tsk->sighand to
work with.

Long term, pulling pid_ns out of nsproxy might be the cleanest solution.

Signed-off-by: Eric W. Biederman 

[ Eric's patch fixed to take care of free_pid() too ]

Signed-off-by: Serge E. Hallyn 
Signed-off-by: Linus Torvalds

Revert "[PATCH] namespaces: fix exit race by splitting exit"

2007-01-30T21:35:18+00:00

This reverts commit 7a238fcba0629b6f2edbcd37458bae56fcf36be5 in
preparation for a better and simpler fix proposed by Eric Biederman
(and fixed up by Serge Hallyn)

Acked-by: Serge E. Hallyn 
Signed-off-by: Linus Torvalds

[PATCH] namespaces: fix exit race by splitting exit

2007-01-30T16:26:44+00:00

Fix exit race by splitting the nsproxy putting into two pieces.  First
piece reduces the nsproxy refcount.  If we dropped the last reference, then
it puts the mnt_ns, and returns the nsproxy as a hint to the caller.  Else
it returns NULL.  The second piece of exiting task namespaces sets
tsk->nsproxy to NULL, and drops the references to other namespaces and
frees the nsproxy only if an nsproxy was passed in.

A little awkward and should probably be reworked, but hopefully it fixes
the NFS oops.

Signed-off-by: Serge E. Hallyn 
Cc: Herbert Poetzl 
Cc: Oleg Nesterov 
Cc: "Eric W. Biederman" 
Cc: Cedric Le Goater 
Cc: Daniel Hokka Zakrisson 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] restore ->pdeath_signal behaviour

2006-12-31T22:41:18+00:00

Commit b2b2cbc4b2a2f389442549399a993a8306420baf introduced a user-
visible change: ->pdeath_signal is sent only when the entire thread
group exits.

While this change is imho good, it may break things.  So restore the
old behaviour for now.

Signed-off-by: Oleg Nesterov 
To: Albert Cahalan 
Cc: Eric W. Biederman 
Cc: Andrew Morton 
Cc: Linus Torvalds 
Cc: Ingo Molnar 
Cc: Qi Yong 
Cc: Roland McGrath 
Signed-off-by: Linus Torvalds

[PATCH] Fix reparenting to the same thread group. (take 2)

2006-12-22T17:03:41+00:00

This patch fixes the case when we reparent to a different thread in the
same thread group.  This modifies the code so that we do not send
signals and do not change the signal to send to SIGCHLD unless we have
change the thread group of our parents.  It also suppresses sending
pdeath_sig in this cas as well since the result of geppid doesn't
change.

Thanks to Oleg for spotting my bug of only fixing this for non-ptraced
tasks.

Signed-off-by: Eric W. Biederman 
Cc: Mike Galbraith 
Cc: Albert Cahalan 
Cc: Andrew Morton 
Cc: Roland McGrath 
Cc: Ingo Molnar 
Cc: Coywolf Qi Hunt 
Acked-by: Oleg Nesterov 
Signed-off-by: Linus Torvalds

[PATCH] fdtable: Provide free_fdtable() wrapper

2006-12-22T16:55:50+00:00

Christoph Hellwig has expressed concerns that the recent fdtable changes
expose the details of the RCU methodology used to release no-longer-used
fdtable structures to the rest of the kernel.  The trivial patch below
addresses these concerns by introducing the appropriate free_fdtable()
calls, which simply wrap the release RCU usage.  Since free_fdtable() is a
one-liner, it makes sense to promote it to an inline helper.

Signed-off-by: Vadim Lobanov 
Cc: Christoph Hellwig 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] fdtable: Remove the free_files field

2006-12-10T17:57:22+00:00

An fdtable can either be embedded inside a files_struct or standalone (after
being expanded).  When an fdtable is being discarded after all RCU references
to it have expired, we must either free it directly, in the standalone case,
or free the files_struct it is contained within, in the embedded case.

Currently the free_files field controls this behavior, but we can get rid of
it entirely, as all the necessary information is already recorded.  We can
distinguish embedded and standalone fdtables using max_fds, and if it is
embedded we can divine the relevant files_struct using container_of().

Signed-off-by: Vadim Lobanov 
Cc: Christoph Hellwig 
Cc: Al Viro 
Cc: Dipankar Sarma 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] fdtable: Make fdarray and fdsets equal in size

2006-12-10T17:57:22+00:00

Currently, each fdtable supports three dynamically-sized arrays of data: the
fdarray and two fdsets.  The code allows the number of fds supported by the
fdarray (fdtable->max_fds) to differ from the number of fds supported by each
of the fdsets (fdtable->max_fdset).

In practice, it is wasteful for these two sizes to differ: whenever we hit a
limit on the smaller-capacity structure, we will reallocate the entire fdtable
and all the dynamic arrays within it, so any delta in the memory used by the
larger-capacity structure will never be touched at all.

Rather than hogging this excess, we shouldn't even allocate it in the first
place, and keep the capacities of the fdarray and the fdsets equal.  This
patch removes fdtable->max_fdset.  As an added bonus, most of the supporting
code becomes simpler.

Signed-off-by: Vadim Lobanov 
Cc: Christoph Hellwig 
Cc: Al Viro 
Cc: Dipankar Sarma 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] session_of_pgrp: kill unnecessary do_each_task_pid(PIDTYPE_PGID)

2006-12-08T16:28:52+00:00

All members of the process group have the same sid and it can't be == 0.

NOTE: this code (and a similar one in sys_setpgid) was needed because it
was possibe to have ->session == 0. It's not possible any longer since

	[PATCH] pidhash: don't use zero pids
	Commit: c7c6464117a02b0d54feb4ebeca4db70fa493678

Signed-off-by: Oleg Nesterov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds