cvs commit: src/sys/kern sys_pipe.c src/sys/sys pipe.h
kib at FreeBSD.org
Fri May 23 11:14:04 UTC 2008
kib 2008-05-23 11:14:03 UTC
FreeBSD src repository
Another problem caused by the knlist_cleardel() potentially dropping
Since the pipe_present is cleared before (potentially) sleeping, the
second thread may enter the pipeclose() for the reciprocal pipe end.
The test at the end of the pipeclose() for the pipe_present == 0 would
succeed, allowing the second thread to free the pipe memory. First
threads then accesses the freed memory after being woken up.
Properly track the closing state of the pipe in the pipe_present.
Introduce the intermediate state that marks the pipe as mostly
dismantled but might be sleeping waiting for the knote list to be
cleared. Free the pipe pair memory only when both ends pass that point.
Debugging help and tested by: pho
Discussed with: jmg
MFC after: 2 weeks
Revision Changes Path
1.198 +22 -11 src/sys/kern/sys_pipe.c
1.30 +7 -0 src/sys/sys/pipe.h
More information about the cvs-src