diff options
| author | Patrick Mooney <pmooney@pfmooney.com> | 2017-01-31 20:45:48 +0000 |
|---|---|---|
| committer | Patrick Mooney <pmooney@pfmooney.com> | 2017-02-03 01:13:00 +0000 |
| commit | bb5f80bc6bcc1afd7ddd42ccdb7612405a37e169 (patch) | |
| tree | 480a42617ee33e7b6f47d2c6a7859b80167a927d /usr/src/uts/common/os/timer.c | |
| parent | 1ec9fd68b738184fa9b6833ee0b3bf6acf58a829 (diff) | |
| download | illumos-joyent-bb5f80bc6bcc1afd7ddd42ccdb7612405a37e169.tar.gz | |
OS-5931 p_itimer access can race during resize
Reviewed by: Ryan Zezeski <ryan.zeseski@joyent.com>
Reviewed by: Jerry Jelinek <jerry.jelinek@joyent.com>
Approved by: Jerry Jelinek <jerry.jelinek@joyent.com>
Diffstat (limited to 'usr/src/uts/common/os/timer.c')
| -rw-r--r-- | usr/src/uts/common/os/timer.c | 27 |
1 files changed, 16 insertions, 11 deletions
diff --git a/usr/src/uts/common/os/timer.c b/usr/src/uts/common/os/timer.c index e87e759563..5453ebf380 100644 --- a/usr/src/uts/common/os/timer.c +++ b/usr/src/uts/common/os/timer.c @@ -25,7 +25,7 @@ */ /* - * Copyright 2016 Joyent, Inc. + * Copyright 2017 Joyent, Inc. */ #include <sys/timer.h> @@ -202,20 +202,20 @@ timer_delete_locked(proc_t *p, timer_t tid, itimer_t *it) static itimer_t * timer_grab(proc_t *p, timer_t tid) { - itimer_t **itp, *it; + itimer_t *it; if (tid < 0) { return (NULL); } mutex_enter(&p->p_lock); - - if ((itp = p->p_itimer) == NULL || tid >= p->p_itimer_sz || - (it = itp[tid]) == NULL) { + if (p->p_itimer == NULL || tid >= p->p_itimer_sz || + (it = p->p_itimer[tid]) == NULL) { mutex_exit(&p->p_lock); return (NULL); } + /* This may drop p_lock temporarily. */ timer_lock(p, it); if (it->it_lock & ITLK_REMOVE) { @@ -961,17 +961,20 @@ timer_lwpexit(void) uint_t i; proc_t *p = curproc; klwp_t *lwp = ttolwp(curthread); - itimer_t *it, **itp; + itimer_t *it; ASSERT(MUTEX_HELD(&p->p_lock)); - if ((itp = p->p_itimer) == NULL) + if (p->p_itimer == NULL) { return; + } for (i = 0; i < p->p_itimer_sz; i++) { - if ((it = itp[i]) == NULL) + if ((it = p->p_itimer[i]) == NULL) { continue; + } + /* This may drop p_lock temporarily. */ timer_lock(p, it); if ((it->it_lock & ITLK_REMOVE) || it->it_lwp != lwp) { @@ -1005,17 +1008,19 @@ timer_lwpbind() uint_t i; proc_t *p = curproc; klwp_t *lwp = ttolwp(curthread); - itimer_t *it, **itp; + itimer_t *it; ASSERT(MUTEX_HELD(&p->p_lock)); - if ((itp = p->p_itimer) == NULL) + if (p->p_itimer == NULL) { return; + } for (i = 0; i < p->p_itimer_sz; i++) { - if ((it = itp[i]) == NULL) + if ((it = p->p_itimer[i]) == NULL) continue; + /* This may drop p_lock temporarily. */ timer_lock(p, it); if (!(it->it_lock & ITLK_REMOVE) && it->it_lwp == lwp) { |