Date: Wed, 09 Mar 2016 16:51:14 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 207848] knote list lock may be held forever when knlist_remove_kq() is called while another function is trying to acquire the lock Message-ID: <bug-207848-8@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D207848 Bug ID: 207848 Summary: knote list lock may be held forever when knlist_remove_kq() is called while another function is trying to acquire the lock Product: Base System Version: 10.2-STABLE Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: kern Assignee: freebsd-bugs@FreeBSD.org Reporter: jtl@freebsd.org As reported in review D4893, it is possible for a knote list lock to be held forever. The sequence of events is: Thread 1 obtains the knlist lock. Thread 2 hits KN_LIST_LOCK(). It finds that kn->kn_knlist is non-NULL, so it waits to acquire the knlist lock. Thread 1 calls knlist_remove_kq(). This sets kn->kn_knlist to NULL. It then releases the knlist lock. Thread 2 obtains the knlist lock. Thread 2 hits KN_LIST_UNLOCK(). It finds that kn->kn_knlist is NULL, so it = does not release the knlist lock. The fix seems to be to recheck kn->kn_knlist after acquiring the lock, and = then immediately release the lock. The submitter of review D4893 is going to wor= k on a patch. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-207848-8>