NetBSD Problem Report #42663

From www@NetBSD.org  Fri Jan 22 20:50:16 2010
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by www.NetBSD.org (Postfix) with ESMTP id E71EA63C556
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 22 Jan 2010 20:50:16 +0000 (UTC)
Message-Id: <20100122205016.B869963C54F@www.NetBSD.org>
Date: Fri, 22 Jan 2010 20:50:16 +0000 (UTC)
From: rmind@netbsd.org
Reply-To: rmind@netbsd.org
To: gnats-bugs@NetBSD.org
Subject: lwp_exit() might race with lwp_free()
X-Send-Pr-Version: www-1.0


>Number:         42663
>Category:       kern
>Synopsis:       lwp_exit() might race with lwp_free()
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jan 22 20:55:00 +0000 2010
>Originator:     Mindaugas Rasiukevicius
>Release:        NetBSD 5.99.24
>Organization:
>Environment:
>Description:
When used with non-curlwp (e.g. _lwp_create() error path), lwp_exit()
might race with lwp_free().  Specifically, cpu_lwp_free() might be in
action while struct lwp is being re-used post-lwp_free().
>How-To-Repeat:
Code inspection.
>Fix:
a) Set p_zomblwp at the last point.
b) Revisit zombie LWP concept after lwp_cache and uvm_uarea_cache merge.

Home	PR Database Search