svn commit: r296320 - in head/sys: kern sys

[Konstantin Belousov]

On Thu, Mar 03, 2016 at 01:29:57PM +0100, Hans Petter Selasky wrote:
> On 03/02/16 19:46, Konstantin Belousov wrote:
> > Modified: head/sys/kern/subr_sleepqueue.c
> > ==============================================================================
> > --- head/sys/kern/subr_sleepqueue.c	Wed Mar  2 16:36:24 2016	(r296319)
> > +++ head/sys/kern/subr_sleepqueue.c	Wed Mar  2 18:46:17 2016	(r296320)
> > @@ -586,7 +586,8 @@ sleepq_check_timeout(void)
> >   	 * another CPU, so synchronize with it to avoid having it
> >   	 * accidentally wake up a subsequent sleep.
> >   	 */
> > -	else if (callout_stop(&td->td_slpcallout) == 0) {
> > +	else if (_callout_stop_safe(&td->td_slpcallout, CS_MIGRBLOCK, NULL)
> > +	    == 0) {
> >   		td->td_flags |= TDF_TIMEOUT;
> >   		TD_SET_SLEEPING(td);
> >   		mi_switch(SW_INVOL | SWT_SLEEPQTIMO, NULL);
> 
> The "td_slpcallout" is not drained anywhere, last time I checked. Does 
> this change require draining of the td_slpcallout in case the thread 
> immediately is exited/destroyed?

callout_stop_safe(CS_MIGRBLOCK) is enough in this case.  td_slpcallout
is only reset from the sleepq code, and the fragment you cited is enough
to guarantee that no spurious wakeup of the unrelated time-bound sleep
happens, because TDF_TIMOFAIL flag cannot be cleared after that.

Struct thread memory is type-stable, so callout subsystem never operates
on the freed memory from td_slpcallout.