You are right, there is a race in pipelined_send, but slightly different
than in your description:
pipelined_send is carefull not to read the msr pointer after
wake_up_process, but it does rely on the contents of the msr structure
after setting msr->r_msg.
I.e. the description is
CPU 1 CPU 2
sys_msgrcv()
(sleeps for messsage)
sys_msgsnd()
pipelined_send()
(woken up by a signal)
Notices that a message is there,
accepts the message and exists.
stack trashed, perhaps even task structure gone.
wake_up_process(msr->r_tsk)
*oops - msr is not valid anymore.
Is that possible? Do you apps use signals?
Your fix solves the problem, but I'd prefer to keep the current, lockless receive path - it avoids 50% of the spinlock operations.
I'll write a patch that adds the missing memory barriers and copies the fields before setting msr->r_msg.
-- Manfred- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Thu Oct 31 2002 - 22:00:48 EST