Page MenuHomeFreeBSD

Fix unsynchronized updates to kn_status.
ClosedPublic

Authored by markj on Nov 20 2018, 9:33 PM.
Tags
None
Referenced Files
Unknown Object (File)
Dec 22 2023, 10:02 PM
Unknown Object (File)
Dec 17 2023, 6:51 PM
Unknown Object (File)
Aug 4 2023, 3:40 AM
Unknown Object (File)
Aug 4 2023, 3:39 AM
Unknown Object (File)
Aug 4 2023, 3:39 AM
Unknown Object (File)
Aug 4 2023, 3:39 AM
Unknown Object (File)
Aug 4 2023, 3:25 AM
Unknown Object (File)
May 21 2023, 6:00 AM
Subscribers

Details

Summary

kn_status is protected by the kqueue's lock, but we were updating it
without the kqueue lock held. For EVFILT_TIMER knotes, there is no
knlist lock, so the knote activation could occur during the kn_status
update following event registration. The activation should enqueue the
knote and set KN_QUEUED, but I have a test case where the KN_QUEUED flag
gets lost, leading to corruption of the queue.

Fix the problem by setting or clearing KN_DISABLED before dropping the
kqueue lock to call into the filter. KN_DISABLED is only used by the
core kevent code, so there is no side effect from setting it earlier.

Test Plan

I have a test program that can trigger the race and a resulting crash; Peter
added it to stress2.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable