* rt/tst-timer2.c: New file.

	* rt/Makefile (tests): Add it.

9 files changed, 93 insertions, 12 deletions

diff --git a/ChangeLog b/ChangeLog
index 35ac3d8ef4..a99e6913b7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2003-07-29  Roland McGrath  <roland@redhat.com>
+
+	* rt/tst-timer2.c: New file.
+	* rt/Makefile (tests): Add it.
+
 2003-07-25  Jakub Jelinek  <jakub@redhat.com>
 
 	* elf/dl-support.c (_dl_hwcap): Add nocommon attribute.
diff --git a/linuxthreads/ChangeLog b/linuxthreads/ChangeLog
index 4d70bb326c..b151dc3406 100644
--- a/linuxthreads/ChangeLog
+++ b/linuxthreads/ChangeLog
@@ -1,3 +1,10 @@
+2003-06-19  Daniel Jacobowitz  <drow@mvista.com>
+
+	* sysdeps/pthread/timer_create.c (timer_create): Call timer_delref
+	before __timer_dealloc.
+	* sysdeps/pthread/timer_routines.c (__timer_thread_find_matching):
+	Don't call list_unlink.
+
 2003-07-29  Roland McGrath  <roland@redhat.com>
 
 	* Makefile [$(build-shared) = yes] (tests): Depend on $(test-modules).
diff --git a/linuxthreads/sysdeps/pthread/timer_create.c b/linuxthreads/sysdeps/pthread/timer_create.c
index 795f94c7d2..d63cda0687 100644
--- a/linuxthreads/sysdeps/pthread/timer_create.c
+++ b/linuxthreads/sysdeps/pthread/timer_create.c
@@ -178,7 +178,10 @@ timer_create (clock_id, evp, timerid)
       if (thread != NULL)
 	__timer_thread_dealloc (thread);
       if (newtimer != NULL)
-	__timer_dealloc (newtimer);
+	{
+	  timer_delref (newtimer);
+	  __timer_dealloc (newtimer);
+	}
     }
 
   pthread_mutex_unlock (&__timer_mutex);
diff --git a/linuxthreads/sysdeps/pthread/timer_routines.c b/linuxthreads/sysdeps/pthread/timer_routines.c
index b88c5e0556..36c26b2a01 100644
--- a/linuxthreads/sysdeps/pthread/timer_routines.c
+++ b/linuxthreads/sysdeps/pthread/timer_routines.c
@@ -538,10 +538,7 @@ __timer_thread_find_matching (const pthread_attr_t *desired_attr,
 
       if (thread_attr_compare (desired_attr, &candidate->attr)
 	  && desired_clock_id == candidate->clock_id)
-	{
-	  list_unlink (iter);
-	  return candidate;
-        }
+	return candidate;
 
       iter = list_next (iter);
     }
diff --git a/nptl/ChangeLog b/nptl/ChangeLog
index 145c719589..45037eb615 100644
--- a/nptl/ChangeLog
+++ b/nptl/ChangeLog
@@ -1,3 +1,10 @@
+2003-06-19  Daniel Jacobowitz  <drow@mvista.com>
+
+	* sysdeps/pthread/timer_create.c (timer_create): Call timer_delref
+	before __timer_dealloc.
+	* sysdeps/pthread/timer_routines.c (__timer_thread_find_matching):
+	Don't call list_unlink.
+
 2003-07-29  Roland McGrath  <roland@redhat.com>
 
 	* Makefile [$(build-shared) = yes] (tests): Depend on $(test-modules).
diff --git a/nptl/sysdeps/pthread/timer_create.c b/nptl/sysdeps/pthread/timer_create.c
index 4ee0966f4e..16aa8100b4 100644
--- a/nptl/sysdeps/pthread/timer_create.c
+++ b/nptl/sysdeps/pthread/timer_create.c
@@ -178,7 +178,10 @@ timer_create (clock_id, evp, timerid)
       if (thread != NULL)
 	__timer_thread_dealloc (thread);
       if (newtimer != NULL)
-	__timer_dealloc (newtimer);
+	{
+	  timer_delref (newtimer);
+	  __timer_dealloc (newtimer);
+	}
     }
 
   pthread_mutex_unlock (&__timer_mutex);
diff --git a/nptl/sysdeps/pthread/timer_routines.c b/nptl/sysdeps/pthread/timer_routines.c
index 7dec0caab1..af6f7412b6 100644
--- a/nptl/sysdeps/pthread/timer_routines.c
+++ b/nptl/sysdeps/pthread/timer_routines.c
@@ -296,7 +296,7 @@ thread_cleanup (void *val)
       thread->current_timer = 0;
 
       if (list_isempty (&thread->timer_queue))
-	  __timer_thread_dealloc (thread);
+	__timer_thread_dealloc (thread);
       else
 	(void) __timer_thread_start (thread);
 
@@ -540,10 +540,7 @@ __timer_thread_find_matching (const pthread_attr_t *desired_attr,
 
       if (thread_attr_compare (desired_attr, &candidate->attr)
 	  && desired_clock_id == candidate->clock_id)
-	{
-	  list_unlink (iter);
-	  return candidate;
-        }
+	return candidate;
 
       iter = list_next (iter);
     }
diff --git a/rt/Makefile b/rt/Makefile
index 9f49a02e0c..47167890a0 100644
--- a/rt/Makefile
+++ b/rt/Makefile
@@ -38,7 +38,7 @@ librt-routines = $(aio-routines) \
 		 $(clock-routines) $(timer-routines) \
 		 $(shm-routines)
 
-tests := tst-shm tst-clock tst-clock_nanosleep tst-timer \
+tests := tst-shm tst-clock tst-clock_nanosleep tst-timer tst-timer2 \
 	 tst-aio tst-aio64 tst-aio2 tst-aio3 tst-aio4 tst-aio5 tst-aio6 \
 	 tst-aio7
 
diff --git a/rt/tst-timer2.c b/rt/tst-timer2.c
new file mode 100644
index 0000000000..74ccc492b0
--- /dev/null
+++ b/rt/tst-timer2.c
@@ -0,0 +1,62 @@
+/* Test for crashing bugs when trying to create too many timers.  */
+
+#include <stdio.h>
+#include <time.h>
+#include <signal.h>
+#include <sys/time.h>
+#include <sys/resource.h>
+#include <unistd.h>
+
+#if _POSIX_THREADS
+# include <pthread.h>
+
+void
+thread (union sigval arg)
+{
+  puts ("Timeout");
+}
+
+int
+do_test (void)
+{
+  int i, res;
+  timer_t timerId;
+  struct itimerspec itval;
+  struct sigevent sigev;
+
+  itval.it_interval.tv_sec = 2;
+  itval.it_interval.tv_nsec = 0;
+  itval.it_value.tv_sec = 2;
+  itval.it_value.tv_nsec = 0;
+
+  sigev.sigev_notify = SIGEV_THREAD;
+  sigev.sigev_signo = SIGRTMIN;
+  sigev.sigev_notify_function = thread;
+  sigev.sigev_notify_attributes = 0;
+  sigev.sigev_value.sival_ptr = (void *) &timerId;
+
+  for (i = 0; i < 100; i++)
+    {
+      printf ("cnt = %d\n", i);
+
+      if (timer_create (CLOCK_REALTIME, &sigev, &timerId) < 0)
+	perror ("timer_create");
+
+      res = timer_settime (timerId, 0, &itval, NULL);
+      if (res < 0)
+	perror ("timer_settime");
+
+      res = timer_delete (timerId);
+      if (res < 0)
+	perror ("timer_delete");
+    }
+
+  return 0;
+}
+
+# define TEST_FUNCTION do_test ()
+#else
+# define TEST_FUNCTION 0
+#endif
+
+#include "../test-skeleton.c"