ipc/sem.c: fix race with concurrent semtimedop() timeouts and IPC_RMID
 

On Fri, Mar 02, 2012 at 01:18:54PM -0300, Herton R. Krzesinski wrote:
> SRU justification
> =================
>
> Impact
> ------
> Kernel crash, due to race explained in upstream bug report:
> https://bugzilla.kernel.org/show_bug.cgi?id=27142
> In practice likely to happen on a highly loaded webserver
>
> Fix
> ---
> Upstream commit d694ad62bf539dbb20a0899ac2a954555f9e4a83
>
> Testcase
> --------
> https://bugzilla.kernel.org/attachment.cgi?id=66162
> I'll attach to this bug as well.
> - Build with gcc -o timedrm timedrm.cpp -lpthread
> - Run with "test 250", sometimes you have to run more than one time to get the

Sorry, just copied and pasted directly from the bug, also the command to be run
should have been ./timedrm 250

250 is arbitrary, I used the default maximum nsems parameter on my natty install
(must be less than or equal to SEMMSL) for semget used in the testcase, was easy
to reproduce with this value.

> oops, but it's very easy to get the crash.
>
> Note: only needed for natty. The problem affects 2.6.35 and later, but
> we already got fixes for Maverick/Oneiric through stable, Precise has
> the fix in also.
>
> --
> []'s
> Herton
>
> --
> kernel-team mailing list
> kernel-team@lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
>

--
[]'s
Herton

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team