commit 108150ea78003044e41150c75259447b2c0953b6
author Oleg Nesterov <oleg@tv-sign.ru> Sun Oct 23 20:25:39 2005 +0400
committer Linus Torvalds <torvalds@g5.osdl.org> Mon Oct 24 08:12:35 2005 -0700
tree ffe0b7e59e6ca1c8a4dad18110e485e5c72872bc
parent ba9e358fd04190a59e605c2963a15e014139a707

[PATCH] posix-timers: fix cleanup_timers() and run_posix_cpu_timers() races

1. cleanup_timers() sets timer->task = NULL under tasklist + ->sighand locks.
   That means that this code in posix_cpu_timer_del() and posix_cpu_timer_set()

   		lock_timer(timer);
		if (timer->task == NULL)
			return;
		read_lock(tasklist);
		put_task_struct(timer->task)

   is racy. With this patch timer->task modified and accounted only under
   timer->it_lock. Sadly, this means that dead task_struct won't be freed
   until timer deleted or armed.

2. run_posix_cpu_timers() collects expired timers into local list under
   tasklist + ->sighand again. That means that posix_cpu_timer_del()
   should check timer->it.cpu.firing under these locks too.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>