Bug in semop() in multiprocess environment?

Ivan Shcheklein shcheklein at gmail.com
Sun Nov 18 09:23:53 PST 2007


Hi All,

It seems to me that there is a bug in the semop() code:

After wakeup we see the following:

        /*
         * The semaphore is still alive.  Readjust the count of
         * waiting processes.
         */
        if (sopptr->sem_op == 0)
            semptr->semzcnt--;
        else
            semptr->semncnt--;

It seems to me that "semptr" can be invalid after wakeup. For example,
semaphore's base can be changed after remove called on another previously
created semaphore.

I think semptr must be renewed after wakeup.

Ivan Shcheklein


More information about the freebsd-bugs mailing list