Oleg Nesterov 96347e7759 posix timers: release_posix_timer: kill the bogus put_task_struct(->it_process); ... release_posix_timer() can't be called with ->it_process != NULL. Once sys_timer_create() sets ->it_process it must not call release_posix_timer(), otherwise we can race with another thread doing sys_timer_delete(), this timer is visible to idr_find() and unlocked. The same is true for two other callers (actually, for any possible caller), sys_timer_delete() and itimer_delete(). They must clear ->it_process before unlock_timer() + release_posix_timer(). Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru> Acked-by: Roland McGrath <roland@redhat.com> Cc: john stultz <johnstul@us.ibm.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Roland McGrath <roland@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2008-07-25 10:53:38 -07:00
..
irq	kernel/irq/manage.c: replace a printk + WARN_ON() to a WARN()	2008-07-25 10:53:29 -07:00
power	pm: fix try_to_freeze_tasks()'s use of do_div()	2008-07-24 10:47:24 -07:00
time	Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip	2008-07-24 12:55:01 -07:00
trace	cpumask: Replace cpumask_of_cpu with cpumask_of_cpu_ptr	2008-07-18 22:02:57 +02:00
.gitignore
acct.c
audit.c
audit.h
audit_tree.c
auditfilter.c
auditsc.c	x86_64 syscall audit fast-path	2008-07-23 17:47:32 -07:00
backtracetest.c
bounds.c
capability.c	security: filesystem capabilities refactor kernel code	2008-07-24 10:47:22 -07:00
cgroup.c	cgroup_clone: use pid of newly created task for new cgroup	2008-07-25 10:53:37 -07:00
cgroup_debug.c
compat.c
configs.c
cpu.c	Merge branch 'sched/for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip	2008-07-23 19:36:53 -07:00
cpuset.c	cpuset: two minor code-cleanups	2008-07-25 10:53:38 -07:00
delayacct.c
dma.c
exec_domain.c	remove CONFIG_KMOD from core kernel code	2008-07-22 19:24:31 +10:00
exit.c	fix dangling zombie when new parent ignores children	2008-07-16 18:02:34 -07:00
extable.c
fork.c	cgroup_clone: use pid of newly created task for new cgroup	2008-07-25 10:53:37 -07:00
futex.c
futex_compat.c
hrtimer.c	Merge branch 'generic-ipi' into generic-ipi-for-linus	2008-07-15 21:55:59 +02:00
itimer.c
kallsyms.c	kallsyms: fix potential overflow in binary search	2008-07-25 10:53:27 -07:00
Kconfig.hz	sched: fix hrtick & generic-ipi dependency	2008-07-23 11:18:28 +02:00
Kconfig.preempt
kexec.c
kfifo.c
kgdb.c
kmod.c	call_usermodehelper(): increase reliability	2008-07-25 10:53:28 -07:00
kprobes.c	kprobes: remove redundant config check	2008-07-25 10:53:30 -07:00
ksysfs.c
kthread.c	kthread: reduce stack pressure in create_kthread and kthreadd	2008-07-18 18:46:58 +02:00
latencytop.c
lockdep.c	Merge branch 'core/locking' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip	2008-07-14 14:55:13 -07:00
lockdep_internals.h
lockdep_proc.c
Makefile	build kernel/profile.o only when requested	2008-07-25 10:53:27 -07:00
marker.c
module.c	modules: Take a shortcut for checking if an address is in a module	2008-07-22 19:24:28 +10:00
mutex-debug.c
mutex-debug.h
mutex.c
mutex.h
notifier.c
ns_cgroup.c	cgroup_clone: use pid of newly created task for new cgroup	2008-07-25 10:53:37 -07:00
nsproxy.c	cgroup_clone: use pid of newly created task for new cgroup	2008-07-25 10:53:37 -07:00
panic.c	Add a WARN() macro; this is WARN_ON() + printk arguments	2008-07-25 10:53:29 -07:00
params.c
pid.c
pid_namespace.c
pm_qos_params.c
posix-cpu-timers.c
posix-timers.c	posix timers: release_posix_timer: kill the bogus put_task_struct(->it_process);	2008-07-25 10:53:38 -07:00
printk.c	printk ratelimiting rewrite	2008-07-25 10:53:29 -07:00
profile.c	build kernel/profile.o only when requested	2008-07-25 10:53:27 -07:00
ptrace.c	ptrace children revamp	2008-07-16 18:02:33 -07:00
rcuclassic.c	Merge branch 'linus' into cpus4096	2008-07-16 00:29:07 +02:00
rcupdate.c	Merge branch 'generic-ipi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip	2008-07-15 14:12:03 -07:00
rcupreempt.c	Merge branch 'linus' into cpus4096	2008-07-16 00:29:07 +02:00
rcupreempt_trace.c
rcutorture.c
relay.c
res_counter.c	cgroup files: convert res_counter_write() to be a cgroups write_string() handler	2008-07-25 10:53:36 -07:00
resource.c
rtmutex-debug.c
rtmutex-debug.h
rtmutex-tester.c	sysdev: Pass the attribute to the low level sysdev show/store function	2008-07-21 21:55:02 -07:00
rtmutex.c
rtmutex.h
rtmutex_common.h
rwsem.c
sched.c	Merge branch 'sched/for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip	2008-07-23 19:36:53 -07:00
sched_clock.c	Merge branch 'sched/clock' into sched/devel	2008-07-14 12:19:13 +02:00
sched_cpupri.c
sched_cpupri.h
sched_debug.c
sched_fair.c	Merge branch 'sched/for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip	2008-07-23 19:36:53 -07:00
sched_features.h
sched_idletask.c
sched_rt.c	Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip	2008-07-24 12:53:51 -07:00
sched_stats.h
seccomp.c
semaphore.c
signal.c
smp.c	generic ipi function calls: wait on alloc failure fallback	2008-07-15 14:12:20 -07:00
softirq.c	Merge branch 'linus' into timers/nohz	2008-07-18 19:53:16 +02:00
softlockup.c	softlockup: print a module list on being stuck	2008-07-05 08:51:24 +02:00
spinlock.c
srcu.c
stacktrace.c
stop_machine.c	cpumask: Replace cpumask_of_cpu with cpumask_of_cpu_ptr	2008-07-18 22:02:57 +02:00
sys.c	call_usermodehelper(): increase reliability	2008-07-25 10:53:28 -07:00
sys_ni.c	flag parameters: fix compile error of sys_epoll_create1	2008-07-25 10:53:26 -07:00
sysctl.c	printk ratelimiting rewrite	2008-07-25 10:53:29 -07:00
sysctl_check.c
taskstats.c
test_kprobes.c
time.c
timeconst.pl
timer.c	Merge branch 'for-linus' of master.kernel.org:/home/rmk/linux-2.6-arm	2008-07-14 16:06:58 -07:00
tsacct.c
uid16.c
user.c
user_namespace.c
utsname.c
utsname_sysctl.c
wait.c
workqueue.c	pm: introduce new interfaces schedule_work_on() and queue_work_on()	2008-07-24 10:47:23 -07:00