lkml.org 
[lkml]   [2007]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [BUG]: posix timer: slab error 'double free'
    (maintainers cc'ed)

    On 08/21, taoyue wrote:
    >
    > I write a simple stress test program for posix timer subsystem, to
    > reproduce the problem in the lastest mainline kernel.
    > My test program creates 200 threads, and each thread does the following job:
    >
    > Please see my test program in the attachemnt "posix_timer_test.c". You
    > can compile my test program via the following command line:

    Now we have a testcase. Great, thanks a lot!

    Unfortunately, I can't use it because my /lib/libc-2.3.3.so doesn't implement
    SIGEV_THREAD (this is a user-space thing).

    However,

    > [<c0103941>] show_trace_log_lvl+0x1a/0x30
    > [<c0104593>] show_trace+0x12/0x14
    > [<c01045ab>] dump_stack+0x16/0x18
    > [<c015637b>] __slab_error+0x26/0x28
    > [<c0156bbf>] cache_free_debugcheck+0x1d9/0x298
    > [<c0156eaa>] kmem_cache_free+0x66/0xb5
    > [<c0122f4d>] __sigqueue_free+0x2f/0x32
    > [<c0123147>] __dequeue_signal+0xdc/0x174
    > [<c0124960>] dequeue_signal+0xbb/0x149
    > [<c012569e>] sys_rt_sigtimedwait+0x7f/0x240
    > [<c01029e6>] syscall_call+0x7/0xb

    This is very nice trace, which says loudly that sigqueue_free() is racy
    wrt collect_signal(). Very old bug, very small window.

    I'll try to send the "right" fix tomorrow after sleep, but in the meanwhile,
    could you please try the patch at the end?

    (I am _not_ sure this can explain all problems you were seeing, though).

    > And I also apply the four patches from Oleg Nesterov from lkml:
    >
    > http://lkm.org/lkml/2007/8/12/193
    > http://lkm.org/lkml/2007/8/12/194
    > http://lkm.org/lkml/2007/8/12/195
    > http://lkm.org/lkml/2007/8/12/196
    ^^^
    (should be lkml)

    Please drop them, except the first one. They have nothing to do with
    these problems, and in fact you apllied the wrong versions.

    Thanks!

    Oleg.

    --- t/kernel/signal.c~ 2007-08-21 22:29:25.000000000 +0400
    +++ t/kernel/signal.c 2007-08-21 22:30:05.000000000 +0400
    @@ -1305,7 +1305,7 @@ void sigqueue_free(struct sigqueue *q)
    * If the signal is still pending remove it from the
    * pending queue.
    */
    - if (unlikely(!list_empty(&q->list))) {
    + if (1) {
    spinlock_t *lock = &current->sighand->siglock;
    read_lock(&tasklist_lock);
    spin_lock_irqsave(lock, flags);
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-08-21 20:59    [W:3.184 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site