[Bug 207848] knote list lock may be held forever when knlist_remove_kq() is called while another function is trying to acquire the lock

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207848

            Bug ID: 207848
           Summary: knote list lock may be held forever when
                    knlist_remove_kq() is called while another function is
                    trying to acquire the lock
           Product: Base System
           Version: 10.2-STABLE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: jtl at freebsd.org

As reported in review D4893, it is possible for a knote list lock to be held
forever.

The sequence of events is:

Thread 1 obtains the knlist lock.

Thread 2 hits KN_LIST_LOCK(). It finds that kn->kn_knlist is non-NULL, so it
waits to acquire the knlist lock.

Thread 1 calls knlist_remove_kq(). This sets kn->kn_knlist to NULL. It then
releases the knlist lock.

Thread 2 obtains the knlist lock.

Thread 2 hits KN_LIST_UNLOCK(). It finds that kn->kn_knlist is NULL, so it does
not release the knlist lock.

The fix seems to be to recheck kn->kn_knlist after acquiring the lock, and then
immediately release the lock. The submitter of review D4893 is going to work on
a patch.

-- 
You are receiving this mail because:
You are the assignee for the bug.