Messages in this thread | | | Date | Wed, 30 Oct 2002 18:57:37 +0100 | From | Manfred Spraul <> | Subject | linux-kernel@vger ... |
| |
You are right, there is a race in pipelined_send, but slightly different than in your description: pipelined_send is carefull not to read the msr pointer after wake_up_process, but it does rely on the contents of the msr structure after setting msr->r_msg.
I.e. the description is
CPU 1 CPU 2
sys_msgrcv() (sleeps for messsage)
sys_msgsnd() pipelined_send() (woken up by a signal) Notices that a message is there, accepts the message and exists. stack trashed, perhaps even task structure gone. wake_up_process(msr->r_tsk) *oops - msr is not valid anymore.
Is that possible? Do you apps use signals?
Your fix solves the problem, but I'd prefer to keep the current, lockless receive path - it avoids 50% of the spinlock operations. I'll write a patch that adds the missing memory barriers and copies the fields before setting msr->r_msg.
-- Manfred
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |