rw_semaphore bug

From: David Howells (dhowells@cambridge.redhat.com)
Date: Wed Apr 04 2001 - 10:28:46 EST


I've found a bug in the write path of the read/write semaphore stuff (at least
for the i386 arch). The attached kernel module (rwsem.c) and driver program
(driver.c) demonstrate it.

What happens is that once the driver finishes, you end up with a whole load of
processes forked off of driver that are stuck in the D state and are waiting
in down_write_failed(), even though the semaphore is in the unlocked state.


#define __NO_VERSION__
#include <linux/config.h>
#include <linux/module.h>
#include <linux/poll.h>
#include <linux/proc_fs.h>
#include <linux/stat.h>
#include <linux/init.h>
#include <linux/personality.h>
#include <linux/smp_lock.h>
#include <linux/delay.h>

struct proc_dir_entry *rwsem_proc;

struct rw_semaphore rwsem_sem;

static int rwsem_write_proc(struct file *file, const char *buffer, unsigned long count, void *data)
{
        printk("[%05d %08x]: downing\n",current->pid,rwsem_sem.count);
        down_write(&rwsem_sem);
        printk("[%05d %08x]: downed\n",current->pid,rwsem_sem.count);
        mdelay(1);
        printk("[%05d %08x]: upping\n",current->pid,rwsem_sem.count);
        up_write(&rwsem_sem);
        printk("[%05d %08x]: upped\n",current->pid,rwsem_sem.count);

        mdelay(100);

        printk("[%05d %08x]: downing\n",current->pid,rwsem_sem.count);
        down_write(&rwsem_sem);
        printk("[%05d %08x]: downed\n",current->pid,rwsem_sem.count);
        mdelay(1);
        printk("[%05d %08x]: upping\n",current->pid,rwsem_sem.count);
        up_write(&rwsem_sem);
        printk("[%05d %08x]: upped\n",current->pid,rwsem_sem.count);

        return -ENOENT;
}

static int __init rwsem_init_module(void)
{
        printk(KERN_INFO "rwsem loading...\n");

        init_rwsem(&rwsem_sem);

        /* try and create the access point */
        rwsem_proc = create_proc_entry("rwsem",S_IRUGO|S_IWUGO,NULL);
        if (!rwsem_proc)
                return -EEXIST;

        rwsem_proc->write_proc = &rwsem_write_proc;
        return 0;
}

static void __exit rwsem_cleanup_module(void)
{
        printk(KERN_INFO "rwsem unloading\n");

        remove_proc_entry("rwsem",NULL);

}

module_init(rwsem_init_module);
module_exit(rwsem_cleanup_module);


#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>
#include <fcntl.h>

int main(int argc, char *argv[])
{
        int loop, fd, tmp;

        fd = open("/proc/rwsem",O_RDWR);
        if (fd<0) {
                perror("open");
                return 1;
        }

        for (loop=0; loop<50; loop++) {
                switch (fork()) {
                case -1:
                        perror("fork");
                        return 1;
                case 0:
                        write(fd," ",1);
                        exit(1);
                default:
                        break;
                }
        }

        for (loop=0; loop<5; loop++) {
                if (wait(&tmp)<0) {
                        perror("wait");
                        return 1;
                }
        }

        return 0;
}

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Sat Apr 07 2001 - 21:00:14 EST