lkml.org 
[lkml]   [2002]   [Oct]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject linux-kernel@vger ...
You are right, there is a race in pipelined_send, but slightly different 
than in your description:
pipelined_send is carefull not to read the msr pointer after
wake_up_process, but it does rely on the contents of the msr structure
after setting msr->r_msg.

I.e. the description is

CPU 1 CPU 2

sys_msgrcv()
(sleeps for messsage)

sys_msgsnd()
pipelined_send()
(woken up by a signal)
Notices that a message is there,
accepts the message and exists.
stack trashed, perhaps even task structure gone.
wake_up_process(msr->r_tsk)
*oops - msr is not valid anymore.

Is that possible? Do you apps use signals?

Your fix solves the problem, but I'd prefer to keep the current, lockless receive path - it avoids 50% of the spinlock operations.
I'll write a patch that adds the missing memory barriers and copies the fields before setting msr->r_msg.

--
Manfred


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:30    [W:0.028 / U:0.072 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site