> >
> > + memset (&tes, 0, sizeof(tes));
> > + if (get_user (tes.sigev_value.sival_int, &timer_event_spec->sigev_value.sival_int) ||
> > + __get_user (tes.sigev_signo, &timer_event_spec->sigev_signo) ||
>
> You cant do that one. Suppose the object is across a page boundary. You need
> to check the address range first then use __get_user. In fact its probably
> faster to memcpy the object from user into L1 cache then use it
Jakub, this is your contribution, can you comment on this?
>
> > +asmlinkage int sys_timer_create(clockid_t which_clock,
> > + struct sigevent *timer_event_spec,
> > + timer_t *created_timer_id)
>
> This one has races I think
>
> > + timers = current->posix_timers = itimer_struct_new();
>
> What if two threads sharing timers execute this at the same time. I suspect
> you need to guard this with the tasklist lock perhaps ?
If you have two threads sharing timers the current->posix_timers is
already initialized in fork.c when the clone_flags has the CLONE_ITIMERS
bit set.
So either the current->posix_timers is initialized in the clone or it is
initialized by the first timer_create (in which case there was only one
thread).
>
> Also consider exec and a setuid program getting started with suprise signals
> pending. I suspect execve needs to kill these timers ?
The timers are not inherited/copied across a fork, so do pending
signals.
I don't see the problem. Am I missing something?
Of course when you do a clone() with CLONE_ITIMERS you share the itimers
of the parent process/thread.
Signal queues cannot be shared between threads. I recall that this is one
of the remaining incompatibilities of LinuxThreads with POSIX threads.
Robert
-- Robert de Vries rhdv@rhdv.cistron.nl
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/