Page Menu
Home
FreeBSD
Search
Configure Global Search
Log In
Files
F148479093
D41982.1787045832.diff
No One
Temporary
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Flag For Later
Award Token
Size
1 KB
Referenced Files
None
Subscribers
None
D41982.1787045832.diff
View Options
diff --git a/sys/kern/sys_timerfd.c b/sys/kern/sys_timerfd.c
--- a/sys/kern/sys_timerfd.c
+++ b/sys/kern/sys_timerfd.c
@@ -59,6 +59,8 @@
#endif
static MALLOC_DEFINE(M_TIMERFD, "timerfd", "timerfd structures");
+static struct mtx tfdlist_lock;
+MTX_SYSINIT(tfdlist_lock, &tfdlist_lock, "timerfd list locker", MTX_DEF);
static LIST_HEAD(, timerfd) timerfd_head;
static struct unrhdr64 tfdino_unr;
@@ -125,6 +127,7 @@
struct timespec boottime, diff;
timerfd_getboottime(&boottime);
+ mtx_lock(&tfdlist_lock);
LIST_FOREACH(tfd, &timerfd_head, entry) {
mtx_lock(&tfd->tfd_lock);
if (tfd->tfd_clockid != CLOCK_REALTIME ||
@@ -160,6 +163,7 @@
tfd->tfd_boottim = boottime;
mtx_unlock(&tfd->tfd_lock);
}
+ mtx_unlock(&tfdlist_lock);
}
static int
@@ -318,7 +322,9 @@
seldrain(&tfd->tfd_sel);
knlist_destroy(&tfd->tfd_sel.si_note);
mtx_destroy(&tfd->tfd_lock);
+ mtx_lock(&tfdlist_lock);
LIST_REMOVE(tfd, entry);
+ mtx_unlock(&tfdlist_lock);
free(tfd, M_TIMERFD);
fp->f_ops = &badfileops;
@@ -431,7 +437,9 @@
knlist_init_mtx(&tfd->tfd_sel.si_note, &tfd->tfd_lock);
timerfd_getboottime(&tfd->tfd_boottim);
getnanotime(&tfd->tfd_birthtim);
+ mtx_lock(&tfdlist_lock);
LIST_INSERT_HEAD(&timerfd_head, tfd, entry);
+ mtx_unlock(&tfdlist_lock);
error = falloc(td, &fp, &fd, fflags);
if (error != 0)
File Metadata
Details
Attached
Mime Type
text/plain
Expires
Tue, Aug 18, 9:37 AM (14 h, 8 s)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
29424104
Default Alt Text
D41982.1787045832.diff (1 KB)
Attached To
Mode
D41982: timerfd: kernel random crash due to race condition to access the timerfd list
Attached
Detach File
Event Timeline
Log In to Comment