Linus Torvalds writes: (Summary)
So the page locking code is racy because you could have this:
So the page locking code is racy because you could have this:
- another cpu does the unlock_page() and wakes up the process (and
uses the exclusive event)
uses the exclusive event)
- we then get a lethal signal before we get toi the "signal_pending_state()" state.
"signal_pending_state()" state.
- we end up prioritizing the lethal signal, because obviously we don't care about locking the page any more.
don't care about locking the page any more.
- so now the lock bit may be still clear and there's nobody who is going to wake up the remaining waiter
going to wake up the remaining waiter
Moving the signal_pending_state() down actually fixes the race, because we know that in order for the exclusive thing to have mattered, it *has* to actually wake us up.
uses the exclusive event)
- we then get a lethal signal before we get toi the "signal_pending_state()" state.
"signal_pending_state()" state.
- we end up prioritizing the lethal signal, because obviously we don't care about locking the page any more.
don't care about locking the page any more.
- so now the lock bit may be still clear and there's nobody who is going to wake up the remaining waiter
going to wake up the remaining waiter
Moving the signal_pending_state() down actually fixes the race, because we know that in order for the exclusive thing to have mattered, it *has* to actually wake us up.