svn commit: r368254 - in releng: 12.1/sys/kern 12.2/sys/kern

[Gordon Tetlow]

Author: gordon
Date: Tue Dec  1 19:37:33 2020
New Revision: 368254
URL: https://svnweb.freebsd.org/changeset/base/368254

Log:
  Fix race condition in callout CPU migration.
  
  Approved by:	so
  Security:	FreeBSD-EN-20:22.callout

Modified:
  releng/12.1/sys/kern/kern_timeout.c
  releng/12.2/sys/kern/kern_timeout.c

Modified: releng/12.1/sys/kern/kern_timeout.c
==============================================================================
--- releng/12.1/sys/kern/kern_timeout.c	Tue Dec  1 19:36:37 2020	(r368253)
+++ releng/12.1/sys/kern/kern_timeout.c	Tue Dec  1 19:37:33 2020	(r368254)
@@ -1270,7 +1270,7 @@ again:
 			 * just wait for the current invocation to
 			 * finish.
 			 */
-			while (cc_exec_curr(cc, direct) == c) {
+			if (cc_exec_curr(cc, direct) == c) {
 				/*
 				 * Use direct calls to sleepqueue interface
 				 * instead of cv/msleep in order to avoid
@@ -1318,7 +1318,7 @@ again:
 
 				/* Reacquire locks previously released. */
 				PICKUP_GIANT();
-				CC_LOCK(cc);
+				goto again;
 			}
 			c->c_flags &= ~CALLOUT_ACTIVE;
 		} else if (use_lock &&

Modified: releng/12.2/sys/kern/kern_timeout.c
==============================================================================
--- releng/12.2/sys/kern/kern_timeout.c	Tue Dec  1 19:36:37 2020	(r368253)
+++ releng/12.2/sys/kern/kern_timeout.c	Tue Dec  1 19:37:33 2020	(r368254)
@@ -1271,7 +1271,7 @@ again:
 			 * just wait for the current invocation to
 			 * finish.
 			 */
-			while (cc_exec_curr(cc, direct) == c) {
+			if (cc_exec_curr(cc, direct) == c) {
 				/*
 				 * Use direct calls to sleepqueue interface
 				 * instead of cv/msleep in order to avoid
@@ -1319,7 +1319,7 @@ again:
 
 				/* Reacquire locks previously released. */
 				PICKUP_GIANT();
-				CC_LOCK(cc);
+				goto again;
 			}
 			c->c_flags &= ~CALLOUT_ACTIVE;
 		} else if (use_lock &&