Re: Race condition in 2.4 tasklet handling (cli() broken?)

[TeJun Huh]

 Additional suspicious things.

1. tasklet_kill() has similar race condition.  mb() required before
tasklet_unlock_wait().

2. local_bh_count() and global_bh_lock tests inside wait_on_irq()
suggests that cli() tries to block not only interrupt handling but all
softirq handlings of all cpus; however, current implementation does
not guarantee that.

 Because local_bh_count is adjusted in do_softirq() _after_
decrementing local_irq_count(), other cpus may happily begin
softirq/tasklet/bh handling while a cpu is inside cli() - sti()
critical section.

 If softirq handling is not guaranteed to be blocked during cli() -
sti() critical section, local_bh_count() and global_bh_lock tests
inside wait_on_irq() are redundant, and if it should be guranteed,
current implementation seems broken.

-- 
tejun
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/