Race in net/socket.c?

From: Duncan Sands (baldrick@wanadoo.fr)
Date: Tue Oct 29 2002 - 08:37:16 EST


I am trying to understand the locking in net/socket.c.
Suppose the system is uniprocessor (no preemption).
Then the various locking routines do nothing:

#define net_family_write_lock() do { } while(0)
#define net_family_write_unlock() do { } while(0)
#define net_family_read_lock() do { } while(0)
#define net_family_read_unlock() do { } while(0)

Look in sock_create:

        net_family_read_lock();
        ...
        if ((i = net_families[family]->create(sock, protocol)) < 0) <= may sleep
        ...
        net_family_read_unlock();

The call to create(...) may sleep. Suppose during this sleep a task is
run that calls sock_unregister:

int sock_unregister(int family)
{
        if (family < 0 || family >= NPROTO)
                return -1;

        net_family_write_lock();
        net_families[family]=NULL;
        net_family_write_unlock();
        return 0;
}

Since net_family_write_lock() is a noop, this succeeds, and returns.
Happy is my task! It has returned from sock_unregister, so can now,
for example, free memory used for implementing that protocol. But the
original create(...) call is in the middle of using that protocol. Unhappy
am I! I am dead!

What have I missed?

Ciao, Duncan.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Thu Oct 31 2002 - 22:00:41 EST