Module Name: src Committed By: riastradh Date: Sat Jan 23 16:33:49 UTC 2021
Modified Files: src/sys/kern: kern_threadpool.c Log Message: threadpool(9): Fix synchronization between cancel and dispatch. - threadpool_cancel_job_async tried to prevent threadpool_dispatcher_thread from taking the job by setting job->job_thread = NULL and then removing the job from the queue. - But threadpool_cancel_job_async didn't notice job->job_thread is null until after it also removes the job from the queue => double-remove, *boom*. The solution is to teach threadpool_dispatcher_thread to wait until it has acquired the job lock to test whether job->job_thread is still valid before it decides to remove the job from the queue. Fixes PR kern/55948. XXX pullup-9 To generate a diff of this commit: cvs rdiff -u -r1.22 -r1.23 src/sys/kern/kern_threadpool.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/kern/kern_threadpool.c diff -u src/sys/kern/kern_threadpool.c:1.22 src/sys/kern/kern_threadpool.c:1.23 --- src/sys/kern/kern_threadpool.c:1.22 Wed Jan 13 07:34:37 2021 +++ src/sys/kern/kern_threadpool.c Sat Jan 23 16:33:49 2021 @@ -1,4 +1,4 @@ -/* $NetBSD: kern_threadpool.c,v 1.22 2021/01/13 07:34:37 skrll Exp $ */ +/* $NetBSD: kern_threadpool.c,v 1.23 2021/01/23 16:33:49 riastradh Exp $ */ /*- * Copyright (c) 2014, 2018 The NetBSD Foundation, Inc. @@ -81,7 +81,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: kern_threadpool.c,v 1.22 2021/01/13 07:34:37 skrll Exp $"); +__KERNEL_RCSID(0, "$NetBSD: kern_threadpool.c,v 1.23 2021/01/23 16:33:49 riastradh Exp $"); #include <sys/types.h> #include <sys/param.h> @@ -1041,7 +1041,7 @@ threadpool_dispatcher_thread(void *arg) /* There are idle threads, so try giving one a job. */ struct threadpool_job *const job = TAILQ_FIRST(&pool->tp_jobs); - TAILQ_REMOVE(&pool->tp_jobs, job, job_entry); + /* * Take an extra reference on the job temporarily so that * it won't disappear on us while we have both locks dropped. @@ -1053,6 +1053,7 @@ threadpool_dispatcher_thread(void *arg) /* If the job was cancelled, we'll no longer be its thread. */ if (__predict_true(job->job_thread == dispatcher)) { mutex_spin_enter(&pool->tp_lock); + TAILQ_REMOVE(&pool->tp_jobs, job, job_entry); if (__predict_false( TAILQ_EMPTY(&pool->tp_idle_threads))) { /*