On Sat, Nov 27, 2010 at 12:18:55AM +0200, Ohad Ben-Cohen wrote: > But then there's the other (quite reasonable) claim that says we > shouldn't crash the machine because of a non fatal bug: if a crappy > driver messes up, the user (not the developer) will most probably > prefer the machine to keep running with degraded functionality rather > than boot. There's also the quite reasonable expectation that we shouldn't corrupt user data. With locking interfaces, if someone abuses them and they fail to work, then the risk is data corruption due to races. The safe thing in that case is to panic - terminate that thread before it does anything unsafe, thereby preventing data corruption. Yes, it may mean that something becomes unavailable, but that's better than corrupting data. Take a look at the kernel's own spinlock implementation. Do we do lots of checks in there for things like someone passing a NULL pointer to the spinlock, or do we get an oops instead? Also look at the list implementation. Do we check for NULL pointers there, or do we get an oops instead? Same for mutex. The same goes for lots of other infrastructure interfaces. -- To unsubscribe from this list: send the line "unsubscribe linux-omap" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
