Martin Schwidefsky 9f96cb1e8b robust futex thread exit race
Calling handle_futex_death in exit_robust_list for the different robust
mutexes of a thread basically frees the mutex.  Another thread might grab
the lock immediately which updates the next pointer of the mutex.
fetch_robust_entry over the next pointer might therefore branch into the
robust mutex list of a different thread.  This can cause two problems: 1)
some mutexes held by the dead thread are not getting freed and 2) some
mutexs held by a different thread are freed.

The next point need to be read before calling handle_futex_death.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Acked-by: Ingo Molnar <mingo@elte.hu>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-01 07:52:23 -07:00
..
2007-08-31 01:42:23 -07:00
2007-07-16 09:05:47 -07:00
2007-08-22 19:52:44 -07:00
2007-07-18 08:47:40 -07:00
2007-09-20 13:19:59 -07:00
2007-09-20 13:19:59 -07:00
2007-10-01 07:52:23 -07:00
2007-10-01 07:52:23 -07:00
2006-12-07 08:39:36 -08:00
2007-07-16 09:05:50 -07:00
2007-08-11 15:47:42 -07:00
2007-07-20 12:01:34 -07:00
2006-12-04 02:00:22 -05:00
2007-07-31 15:39:40 -07:00
2007-07-16 09:05:47 -07:00
2007-07-19 10:04:49 -07:00
2007-08-22 19:52:46 -07:00
2007-08-11 15:47:42 -07:00
2007-07-16 09:05:49 -07:00
2007-07-16 09:05:49 -07:00
2007-07-16 09:05:49 -07:00
2007-09-19 23:34:46 +02:00
2007-07-16 09:05:50 -07:00
2007-09-20 13:19:59 -07:00
2007-10-01 07:52:23 -07:00
2007-09-19 11:24:18 -07:00
2007-05-09 08:57:56 +02:00
2007-08-27 10:27:48 -07:00