Author: gordon
Date: Tue Dec  1 19:37:33 2020
New Revision: 368254
URL: https://svnweb.freebsd.org/changeset/base/368254

Log:
  Fix race condition in callout CPU migration.
  
  Approved by:  so
  Security:     FreeBSD-EN-20:22.callout

Modified:
  releng/12.1/sys/kern/kern_timeout.c
  releng/12.2/sys/kern/kern_timeout.c

Modified: releng/12.1/sys/kern/kern_timeout.c
==============================================================================
--- releng/12.1/sys/kern/kern_timeout.c Tue Dec  1 19:36:37 2020        
(r368253)
+++ releng/12.1/sys/kern/kern_timeout.c Tue Dec  1 19:37:33 2020        
(r368254)
@@ -1270,7 +1270,7 @@ again:
                         * just wait for the current invocation to
                         * finish.
                         */
-                       while (cc_exec_curr(cc, direct) == c) {
+                       if (cc_exec_curr(cc, direct) == c) {
                                /*
                                 * Use direct calls to sleepqueue interface
                                 * instead of cv/msleep in order to avoid
@@ -1318,7 +1318,7 @@ again:
 
                                /* Reacquire locks previously released. */
                                PICKUP_GIANT();
-                               CC_LOCK(cc);
+                               goto again;
                        }
                        c->c_flags &= ~CALLOUT_ACTIVE;
                } else if (use_lock &&

Modified: releng/12.2/sys/kern/kern_timeout.c
==============================================================================
--- releng/12.2/sys/kern/kern_timeout.c Tue Dec  1 19:36:37 2020        
(r368253)
+++ releng/12.2/sys/kern/kern_timeout.c Tue Dec  1 19:37:33 2020        
(r368254)
@@ -1271,7 +1271,7 @@ again:
                         * just wait for the current invocation to
                         * finish.
                         */
-                       while (cc_exec_curr(cc, direct) == c) {
+                       if (cc_exec_curr(cc, direct) == c) {
                                /*
                                 * Use direct calls to sleepqueue interface
                                 * instead of cv/msleep in order to avoid
@@ -1319,7 +1319,7 @@ again:
 
                                /* Reacquire locks previously released. */
                                PICKUP_GIANT();
-                               CC_LOCK(cc);
+                               goto again;
                        }
                        c->c_flags &= ~CALLOUT_ACTIVE;
                } else if (use_lock &&
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to