xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

kernel: fix alarm postnote race

Browse source 
when alarmkproc is commited to send the alarm note to the process,
the process might have exited already, or worse, being reused for
another process. pexit() zeros p->alarm at the beginning, but the
kalarmproc() might read p->alarm before pexit() zeroed it, decide
to send the note, then get preempted and pexit() releases the proc.
once kalarmproc() is resumed, the proc might be already something
different and we send the note to the wrong thing.

we now check p->alarm under the debug qlock. that way, pexit()
cannot make progress while we test the condition.

remove the error label arround postnote(). postnote does not raise
error.
This commit is contained in:
cinap_lenrek 2014-01-01 05:14:38 +01:00
parent 0feb6e06af
commit f481ac716d
1 changed files with 23 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
sys/src/9/port/alarm.c
View file

@ -11,7 +11,7 @@ void
alarmkproc(void*)
{
Proc *rp;
ulong now;
ulong now, when;
while(waserror())
;
@ -19,20 +19,20 @@ alarmkproc(void*)
for(;;){
now = MACHP(0)->ticks;
qlock(&alarms);
while((rp = alarms.head) && (long)(now - rp->alarm) >= 0){
if(rp->alarm != 0L){
if(canqlock(&rp->debug)){
if(!waserror()){
for(rp = alarms.head; rp != nil; rp = rp->palarm){
if((when = rp->alarm) == 0)
continue;
if((long)(now - when) < 0)
break;
if(!canqlock(&rp->debug))
break;
if(rp->alarm != 0){
postnote(rp, 0, "alarm", NUser);
poperror();
rp->alarm = 0;
}
qunlock(&rp->debug);
rp->alarm = 0L;
}else
break;
}
alarms.head = rp->palarm;
}
alarms.head = rp;
qunlock(&alarms);
sleep(&alarmr, return0, 0);
@ -46,14 +46,16 @@ void
checkalarms(void)
{
Proc *p;
ulong now;
ulong now, when;
p = alarms.head;
if(p != nil){
now = MACHP(0)->ticks;
if(p != nil && (long)(now - p->alarm) >= 0)
when = p->alarm;
if(when == 0 || (long)(now - when) >= 0)
wakeup(&alarmr);
}
}
ulong
procalarm(ulong time)
@ -61,10 +63,9 @@ procalarm(ulong time)
Proc **l, *f;
ulong when, old;
if(up->alarm)
old = tk2ms(up->alarm - MACHP(0)->ticks);
else
old = 0;
old = up->alarm;
if(old)
old = tk2ms(old - MACHP(0)->ticks);
if(time == 0) {
up->alarm = 0;
return old;