From owner-freebsd-bugs@FreeBSD.ORG Wed Aug 20 18:42:02 2014 Return-Path: Delivered-To: freebsd-bugs@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id EE1B7852 for ; Wed, 20 Aug 2014 18:42:02 +0000 (UTC) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id BB4F0389C for ; Wed, 20 Aug 2014 18:42:02 +0000 (UTC) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.14.9/8.14.9) with ESMTP id s7KIg2cG090629 for ; Wed, 20 Aug 2014 18:42:02 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 192863] New: Data race caused by double increment of pq->pq_cnt Date: Wed, 20 Aug 2014 18:42:02 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 10.0-RELEASE X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: pfonseca@mpi-sws.org X-Bugzilla-Status: Needs Triage X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: freebsd-bugs@FreeBSD.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Aug 2014 18:42:03 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=192863 Bug ID: 192863 Summary: Data race caused by double increment of pq->pq_cnt Product: Base System Version: 10.0-RELEASE Hardware: Any OS: Any Status: Needs Triage Severity: Affects Only Me Priority: --- Component: kern Assignee: freebsd-bugs@FreeBSD.org Reporter: pfonseca@mpi-sws.org I've found that there are two accesses to "pq->pq_cnt" that are not synchronized and that can race in FreeBSD 10.0. One of the accesses increments the variable in function "vm_pagequeue_cnt_add()" while the other reads its value in function "vm_pageout_scan()" Strangely "pq->pq_cnt" is currently incremented twice in the function "vm_pagequeue_cnt_add()" (in one instance this is done atomically, in the other it's not). Racing accesses: /usr/src/sys/vm/vm_page.h:246 240 vm_pagequeue_cnt_add(struct vm_pagequeue *pq, int addend) 241 { 242 243 #ifdef notyet 244 vm_pagequeue_assert_locked(pq); 245 #endif ==> 246 pq->pq_cnt += addend; 247 atomic_add_int(pq->pq_vcnt, addend); 248 } /usr/src/sys/vm/vm_pageout.c:962 (vm_pageout_scan) 961 pq = &vmd->vmd_pagequeues[PQ_INACTIVE]; ==> 962 maxscan = pq->pq_cnt; 963 vm_pagequeue_lock(pq); 964 queues_locked = TRUE; 965 for (m = TAILQ_FIRST(&pq->pq_pl); 966 m != NULL && maxscan-- > 0 && page_shortage > 0; -- You are receiving this mail because: You are the assignee for the bug.