diff options
author | Sebastian Huber <sebastian.huber@embedded-brains.de> | 2014-11-27 14:41:17 +0100 |
---|---|---|
committer | Sebastian Huber <sebastian.huber@embedded-brains.de> | 2014-11-28 10:56:46 +0100 |
commit | 3b4ca3ab0f99d15794a3eee60b5735f834fd898c (patch) | |
tree | f1e064023ef85d9179082fe7bb0b9186a5acf366 /cpukit/sapi | |
parent | sync.c: Add asserts to document and check assumptions (diff) | |
download | rtems-3b4ca3ab0f99d15794a3eee60b5735f834fd898c.tar.bz2 |
bdbuf: Fix race condition with sync active flag
Bug report by Oleg Kravtsov:
In rtems_bdbuf_swapout_processing() function there is the following
lines:
if (bdbuf_cache.sync_active && !transfered_buffers)
{
rtems_id sync_requester;
rtems_bdbuf_lock_cache ();
...
}
Here access to bdbuf_cache.sync_active is not protected with anything.
Imagine the following test case:
1. Task1 releases buffer(s) with bdbuf_release_modified() calls;
2. After a while swapout task starts and flushes all buffers;
3. In the end of that swapout flush we are before that part of code, and
assume there is task switching (just before "if (bdbuf_cache.sync_active
&& !transfered_buffers)");
4. Some other task (with higher priority) does bdbuf_release_modified
and rtems_bdbuf_syncdev().
This task successfully gets both locks sync and pool (in
rtems_bdbuf_syncdev() function), sets sync_active to true and starts
waiting for RTEMS_BDBUF_TRANSFER_SYNC event with only sync lock got.
5. Task switching happens again and we are again before "if
(bdbuf_cache.sync_active && !transfered_buffers)".
As the result we check sync_active and we come inside that "if"
statement.
6. The result is that we send RTEMS_BDBUF_TRANSFER_SYNC event! Though
ALL modified messages of that task are not flushed yet!
close #1485
Diffstat (limited to 'cpukit/sapi')
0 files changed, 0 insertions, 0 deletions