[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.DEB.2.21.1911061154520.1869@nanos.tec.linutronix.de>
Date: Wed, 6 Nov 2019 12:07:29 +0100 (CET)
From: Thomas Gleixner <tglx@...utronix.de>
To: Oleg Nesterov <oleg@...hat.com>
cc: Florian Weimer <fweimer@...hat.com>, Shawn Landden <shawn@....icu>,
libc-alpha@...rceware.org, linux-api@...r.kernel.org,
LKML <linux-kernel@...r.kernel.org>,
Arnd Bergmann <arnd@...db.de>,
Deepa Dinamani <deepa.kernel@...il.com>,
Andrew Morton <akpm@...ux-foundation.org>,
Catalin Marinas <catalin.marinas@....com>,
Keith Packard <keithp@...thp.com>,
Peter Zijlstra <peterz@...radead.org>
Subject: Re: handle_exit_race && PF_EXITING
On Wed, 6 Nov 2019, Oleg Nesterov wrote:
> On 11/06, Thomas Gleixner wrote:
> > > + if (unlikely(p->flags & PF_EXITPIDONE)) {
> > > + /* exit_pi_state_list() was already called */
> > > raw_spin_unlock_irq(&p->pi_lock);
> > > put_task_struct(p);
> > > - return ret;
> > > + return -ESRCH;
> >
> > But, this is incorrect because we'd return -ESRCH to user space while the
> > futex value still has the TID of the exiting task set which will
> > subsequently cleanout the futex and set the owner died bit.
>
> Heh. Of course this is not correct. As I said, this patch should be adapted
> to the current code. See below.
>
> > See da791a667536 ("futex: Cure exit race") for example.
>
> Thomas, I simply can't resist ;)
>
> I reported this race when I sent this patch in 2015,
>
> https://lore.kernel.org/lkml/20150205181014.GA20244@redhat.com/
>
> but somehow that discussion died with no result.
Yes. I was not paying attention for some reason. Don't ask me what happened
in Feb. 2015 :)
But even if we adapt that patch to the current code it won't solve the
-ESRCH issue I described above.
> > Guess why that code has more corner case handling than actual
> > functionality. :)
>
> I know why. To confuse me!
Of course. As Rusty said: "Futexes are also cursed"
Thanks,
tglx
Powered by blists - more mailing lists