From owner-p4-projects@FreeBSD.ORG Fri Aug 4 16:01:49 2006 Return-Path: X-Original-To: p4-projects@freebsd.org Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 6D05C16A4E8; Fri, 4 Aug 2006 16:01:49 +0000 (UTC) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4823F16A4DD; Fri, 4 Aug 2006 16:01:49 +0000 (UTC) (envelope-from jhb@freebsd.org) Received: from server.baldwin.cx (66-23-211-162.clients.speedfactory.net [66.23.211.162]) by mx1.FreeBSD.org (Postfix) with ESMTP id 92E2643D46; Fri, 4 Aug 2006 16:01:48 +0000 (GMT) (envelope-from jhb@freebsd.org) Received: from localhost.corp.yahoo.com (john@localhost [127.0.0.1]) (authenticated bits=0) by server.baldwin.cx (8.13.6/8.13.6) with ESMTP id k74G1ikA004558; Fri, 4 Aug 2006 12:01:46 -0400 (EDT) (envelope-from jhb@freebsd.org) From: John Baldwin To: Roman Divacky Date: Fri, 4 Aug 2006 11:41:53 -0400 User-Agent: KMail/1.9.1 References: <200608041238.k74Ccp40076932@repoman.freebsd.org> In-Reply-To: <200608041238.k74Ccp40076932@repoman.freebsd.org> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200608041141.53715.jhb@freebsd.org> X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-2.0.2 (server.baldwin.cx [127.0.0.1]); Fri, 04 Aug 2006 12:01:46 -0400 (EDT) X-Virus-Scanned: ClamAV version 0.87.1, clamav-milter version 0.87 on server.baldwin.cx X-Virus-Status: Clean X-Spam-Status: No, score=-4.4 required=4.2 tests=ALL_TRUSTED,AWL,BAYES_00 autolearn=ham version=3.1.0 X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on server.baldwin.cx Cc: Perforce Change Reviews Subject: Re: PERFORCE change 103162 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Aug 2006 16:01:49 -0000 On Friday 04 August 2006 08:38, Roman Divacky wrote: > http://perforce.freebsd.org/chv.cgi?CH=103162 > > Change 103162 by rdivacky@rdivacky_witten on 2006/08/04 12:38:26 > > Switch to using atomic_add_int() for refcounting. > > > Affected files ... > > .. //depot/projects/soc2006/rdivacky_linuxolator/compat/linux/linux_futex.c#13 edit > > Differences ... > > ==== //depot/projects/soc2006/rdivacky_linuxolator/compat/linux/linux_futex.c#13 (text+ko) ==== > > @@ -274,7 +274,7 @@ > FUTEX_LOCK; > LIST_FOREACH(f, &futex_list, f_list) { > if (f->f_uaddr == uaddr) { > - f->f_refcount++; > + atomic_add_int(&f->f_refcount, 1); > FUTEX_UNLOCK; > return f; > } > @@ -284,7 +284,7 @@ > /* Not found, create it */ > f = malloc(sizeof(*f), M_LINUX, M_WAITOK); > f->f_uaddr = uaddr; > - f->f_refcount = 1; > + atomic_set_int(&f->f_refcount, 1); > TAILQ_INIT(&f->f_waiting_proc); > FUTEX_LOCK; > LIST_INSERT_HEAD(&futex_list, f, f_list); > @@ -297,7 +297,7 @@ > futex_put(f) > struct futex *f; > { > - f->f_refcount--; > + atomic_add_int(&f->f_refcount, -1); > if (f->f_refcount == 0) { > FUTEX_LOCK; > LIST_REMOVE(f, f_list); This is racy. Another thread can obtain a reference after you do the 0 check and you will free out from under it. If you wanted to use atomic ops, you should use the refcount API in sys/refcount.h instead. However, that would still be racy in this case because of the LIST of these structures. Instead, you need to revert this and just hold the FUTEX_LOCK earlier in futex_put() before you do the f->f_refcount-- so that you can remove it from the list safely without other threads gaining a reference to it. -- John Baldwin