From 1bc02a70e2e54d0353dea2f6d1fa4e12c2c46b3b Mon Sep 17 00:00:00 2001 From: Jakub Jermar Date: Fri, 26 Mar 2010 10:38:43 +0100 Subject: 6924278 lwp_exit() race causes proc with bad p_tlist, panicking ps(1) --- usr/src/uts/common/os/lwp.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) (limited to 'usr/src') diff --git a/usr/src/uts/common/os/lwp.c b/usr/src/uts/common/os/lwp.c index 94f29b918e..64c541187d 100644 --- a/usr/src/uts/common/os/lwp.c +++ b/usr/src/uts/common/os/lwp.c @@ -887,6 +887,8 @@ lwp_exit(void) if (PROC_IS_BRANDED(p)) BROP(p)->b_lwpexit(lwp); + lwp_pcb_exit(); + mutex_enter(&p->p_lock); lwp_cleanup(); @@ -898,6 +900,12 @@ lwp_exit(void) if (p->p_flag & SCOREDUMP) stop(PR_SUSPENDED, SUSPEND_NORMAL); + /* + * Block the process against /proc now that we have really acquired + * p->p_lock (to decrement p_lwpcnt and manipulate p_tlist at least). + */ + prbarrier(p); + /* * Call proc_exit() if this is the last non-daemon lwp in the process. */ @@ -916,20 +924,9 @@ lwp_exit(void) */ mutex_enter(&p->p_lock); ASSERT(curproc->p_flag & SEXITLWPS); + prbarrier(p); } - mutex_exit(&p->p_lock); - - lwp_pcb_exit(); - - mutex_enter(&p->p_lock); - - /* - * Block the process against /proc now that we have really acquired - * p->p_lock (to decrement p_lwpcnt and manipulate p_tlist at least). - */ - prbarrier(p); - DTRACE_PROC(lwp__exit); /* -- cgit v1.2.3