cvs commit: src/sys/kern uipc_msg.c

[Matthew Dillon]

dillon      2007/07/04 16:36:26 PDT

DragonFly src repository

  Modified files:
    sys/kern             uipc_msg.c 
  Log:
  Fix an insufficient test of the message flags when determining whether
  an abortable request has already completed or not.
  
  Abort requests are sent to the same port as the original message which
  means that the original message will have been processes and either replied
  to or queued before the abort message is acted upon.  However, when an
  abort message is replied the MSGF_DONE bit is *NOT* set until the reply
  reaches the reply port, potentially requiring an IPI.
  
  This can lead to a race where the code processing an abort request
  incorrectly determines that the message has not yet been replied when in
  fact it has, leading to a double-reply and a panic.
  
  The solution is to test the MSGF_REPLY bit, which is set by the target
  cpu (the one processing the original message) when replying to the message
  prior to issuing any IPI.
  
  Reported-by: Peter Avalos <pavalos at crater.dragonflybsd.org>
  Dragonfly-bug: <http://bugs.dragonflybsd.org/issue717>
  
  Revision  Changes    Path
  1.19      +21 -3     src/sys/kern/uipc_msg.c


http://www.dragonflybsd.org/cvsweb/src/sys/kern/uipc_msg.c.diff?r1=1.18&r2=1.19&f=u