Bug 207848 - knote list lock may be held forever when knlist_remove_kq() is called while another function is trying to acquire the lock
Summary: knote list lock may be held forever when knlist_remove_kq() is called while a...
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 10.2-STABLE
Hardware: Any Any
: --- Affects Only Me
Assignee: Jonathan T. Looney
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-03-09 16:51 UTC by Jonathan T. Looney
Modified: 2018-05-28 19:49 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan T. Looney freebsd_committer freebsd_triage 2016-03-09 16:51:14 UTC
As reported in review D4893, it is possible for a knote list lock to be held forever.

The sequence of events is:

Thread 1 obtains the knlist lock.

Thread 2 hits KN_LIST_LOCK(). It finds that kn->kn_knlist is non-NULL, so it waits to acquire the knlist lock.

Thread 1 calls knlist_remove_kq(). This sets kn->kn_knlist to NULL. It then releases the knlist lock.

Thread 2 obtains the knlist lock.

Thread 2 hits KN_LIST_UNLOCK(). It finds that kn->kn_knlist is NULL, so it does not release the knlist lock.

The fix seems to be to recheck kn->kn_knlist after acquiring the lock, and then immediately release the lock. The submitter of review D4893 is going to work on a patch.
Comment 1 Jonathan T. Looney freebsd_committer freebsd_triage 2016-03-09 16:52:54 UTC
I will work with the submitted of review D4893 to prepare a patch for review by the maintainer.
Comment 2 Eitan Adler freebsd_committer freebsd_triage 2018-05-28 19:49:57 UTC
batch change:

For bugs that match the following
-  Status Is In progress 
AND
- Untouched since 2018-01-01.
AND
- Affects Base System OR Documentation

DO:

Reset to open status.


Note:
I did a quick pass but if you are getting this email it might be worthwhile to double check to see if this bug ought to be closed.