NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

kern/38812: race between lwp_exit_switchaway and exit1/coredump

>Number:         38812
>Category:       kern
>Synopsis:       race between lwp_exit_switchaway and exit1/coredump
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat May 31 18:35:00 +0000 2008
>Originator:     Andrew Doran
>Release:        4.99.62
The NetBSD Project
lwp_exit_switchaway does (l->l_flag &= ~LW_RUNNING) without holding
the LWP locked.

exit1/coredump may set other flags on l_flag, like LW_EXIT. There is
a tiny window where this update may obliterate the previous clearing
of LW_RUNNING by lwp_exit_switchaway.

Result: exit1/coredump later spin in lwp_free, waiting for the zombie
LWP to come off the CPU. Because LW_RUNNING is set it appears that it
is still on the CPU.
Be unlucky.

Move the RUNNING flag into the thread-private flag word, l_pflag.
Testing this without a lock is OK at all the points we care about
the RUNNING flag in particular.

Home | Main Index | Thread Index | Old Index