lkml.org 
[lkml]   [2001]   [Apr]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Subjectrw_semaphore bug
Date
From
I've found a bug in the write path of the read/write semaphore stuff (at least
for the i386 arch). The attached kernel module (rwsem.c) and driver program
(driver.c) demonstrate it.

What happens is that once the driver finishes, you end up with a whole load of
processes forked off of driver that are stuck in the D state and are waiting
in down_write_failed(), even though the semaphore is in the unlocked state.
#define __NO_VERSION__
#include <linux/config.h>
#include <linux/module.h>
#include <linux/poll.h>
#include <linux/proc_fs.h>
#include <linux/stat.h>
#include <linux/init.h>
#include <linux/personality.h>
#include <linux/smp_lock.h>
#include <linux/delay.h>

struct proc_dir_entry *rwsem_proc;

struct rw_semaphore rwsem_sem;

static int rwsem_write_proc(struct file *file, const char *buffer, unsigned long count, void *data)
{
printk("[%05d %08x]: downing\n",current->pid,rwsem_sem.count);
down_write(&rwsem_sem);
printk("[%05d %08x]: downed\n",current->pid,rwsem_sem.count);
mdelay(1);
printk("[%05d %08x]: upping\n",current->pid,rwsem_sem.count);
up_write(&rwsem_sem);
printk("[%05d %08x]: upped\n",current->pid,rwsem_sem.count);

mdelay(100);

printk("[%05d %08x]: downing\n",current->pid,rwsem_sem.count);
down_write(&rwsem_sem);
printk("[%05d %08x]: downed\n",current->pid,rwsem_sem.count);
mdelay(1);
printk("[%05d %08x]: upping\n",current->pid,rwsem_sem.count);
up_write(&rwsem_sem);
printk("[%05d %08x]: upped\n",current->pid,rwsem_sem.count);

return -ENOENT;
}

static int __init rwsem_init_module(void)
{
printk(KERN_INFO "rwsem loading...\n");

init_rwsem(&rwsem_sem);

/* try and create the access point */
rwsem_proc = create_proc_entry("rwsem",S_IRUGO|S_IWUGO,NULL);
if (!rwsem_proc)
return -EEXIST;

rwsem_proc->write_proc = &rwsem_write_proc;
return 0;
}

static void __exit rwsem_cleanup_module(void)
{
printk(KERN_INFO "rwsem unloading\n");

remove_proc_entry("rwsem",NULL);

}

module_init(rwsem_init_module);
module_exit(rwsem_cleanup_module);
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>
#include <fcntl.h>

int main(int argc, char *argv[])
{
int loop, fd, tmp;

fd = open("/proc/rwsem",O_RDWR);
if (fd<0) {
perror("open");
return 1;
}

for (loop=0; loop<50; loop++) {
switch (fork()) {
case -1:
perror("fork");
return 1;
case 0:
write(fd," ",1);
exit(1);
default:
break;
}
}

for (loop=0; loop<5; loop++) {
if (wait(&tmp)<0) {
perror("wait");
return 1;
}
}

return 0;
}
\
 
 \ /
  Last update: 2005-03-22 13:23    [W:0.028 / U:0.108 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site