some possible bugs around (race conditions etc.)

From: Martin Mačok (martin.macok@underground.cz)
Date: Thu Sep 13 2001 - 12:07:41 EST


Hi,
we (Kamil Toman <ktoman@email.cz> and me) were studying linux source
and trying to make some "audit". We went over 2.4.7 source and in the
time of this writing I'm looking at 2.4.9-ac10 to compare if it was
changed. This is a list of possible things we have found:

[ definitely - we're kernel newbies so take us easy ;-) ]

lines according to 2.4.9-ac10:

kernel/capability.c:
59-63, 91-93, 203-206: SMP race, possible fix: rwlock

kernel/exit.c:
485: sys_exit doesn't return anything (nor long type)
        why it isn't void ?
442-447: is this signal handling correct?
501: task INTERRUPTIBLE - possible ineffectivity, couldn't this task
        be woken up too often (early)?

kernel/fork.c:
586: isn't memcpy() more effective?

kernel/acct.c:
SMP race ?:
----------------------------------------------------
CPU1 CPU2

sys_acct(file)
{
    ....
    if (old_acct)

                                sys_acct(NULL)
                                sys_acct(nextfile)
                                {

                                    ....
        do_acct_process() -- BUG!
        filp_close() -- BUG!
----------------------------------------------------

kernel/sys.c:
1217: mixed signed/unsigned - doesn't it return EINVAL even when it
        shouldn't?
1042: what if strlen < len? can we get rid of chars after null?
428: why wmb() ?

kernel/sched.c:
1303-1309: isn't there a same race cond. as in kmod.c:65 ?
1323: is this needed on UP?
603: is this correct on SMP? shouldn't there be some penalty
        accounted for being "randomly" woken/run?

kernel/kmod.c
211: shouldn't module_name be tested a bit?

Comments are welcomed.

Have a nice day

-- 
   Martin Mačok
  underground.cz
    openbsd.cz
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Sat Sep 15 2001 - 21:00:42 EST