d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

The m_ext reference counts are potentially shared and modified

Browse Source 
asynchronously by different threads.  Thus, declare as volatile the
reference count that is accessed through m_ext's pointer, ref_cnt.
Revert the previous change, revision 1.144, that casts as volatile a
single dereference of ref_cnt.

Reviewed by: bmilekic, dwhite
Problem reported by: kris
MFC after: 3 days
This commit is contained in:
alc 2005-03-06 20:09:00 +00:00
parent 4afa67d768
commit 2213f95a52
2 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/kern/uipc_mbuf.c
View File

@ -199,7 +199,7 @@ m_extadd(struct mbuf *mb, caddr_t buf, u_int size,
ref_cnt = (u_int *)uma_find_refcnt(zone_clust,
mb->m_ext.ext_buf);
else if (type == EXT_EXTREF)
ref_cnt = mb->m_ext.ref_cnt;
ref_cnt = __DEVOLATILE(u_int *, mb->m_ext.ref_cnt);
mb->m_ext.ref_cnt = (ref_cnt == NULL) ?
malloc(sizeof(u_int), M_MBUF, M_NOWAIT) : (u_int *)ref_cnt;
if (mb->m_ext.ref_cnt != NULL) {
@ -234,12 +234,9 @@ mb_free_ext(struct mbuf *m)
* This is tricky. We need to make sure to decrement the
* refcount in a safe way but to also clean up if we're the
* last reference. This method seems to do it without race.
* The volatile cast is required to emit the proper load
* instructions. Otherwise gcc will optimize the read outside
* of the while loop.
*/
while (dofree == 0) {
cnt = *(volatile u_int *)(m->m_ext.ref_cnt);
cnt = *(m->m_ext.ref_cnt);
if (atomic_cmpset_int(m->m_ext.ref_cnt, cnt, cnt - 1)) {
if (cnt == 1)
dofree = 1;
@ -262,7 +259,8 @@ mb_free_ext(struct mbuf *m)
m->m_ext.ext_args);
if (m->m_ext.ext_type != EXT_EXTREF) {
if (m->m_ext.ref_cnt != NULL)
free(m->m_ext.ref_cnt, M_MBUF);
free(__DEVOLATILE(u_int *,
m->m_ext.ref_cnt), M_MBUF);
m->m_ext.ref_cnt = NULL;
}
m->m_ext.ext_buf = NULL;

2
sys/sys/mbuf.h
View File

@ -122,7 +122,7 @@ struct m_ext {
(void *, void *);
void *ext_args; /* optional argument pointer */
u_int ext_size; /* size of buffer, for ext_free */
u_int *ref_cnt; /* pointer to ref count info */
volatile u_int *ref_cnt; /* pointer to ref count info */
int ext_type; /* type of external storage */
};