svn commit: r305063 - in stable: 10/sys/kern 11/sys/kern

[Eric Badger]

Author: badger
Date: Tue Aug 30 13:39:42 2016
New Revision: 305063
URL: https://svnweb.freebsd.org/changeset/base/305063

Log:
  MFC r304184:
  
  sem_post(): wake up the sleeper only after adjusting has_waiters
  
  If the caller of sem_post() wakes up a thread sleeping via sem_wait()
  before it clears the has_waiters flag, the caller of sem_wait() has no way of
  knowing when it is safe to destroy the semaphore and reuse the memory. This is
  because the caller of sem_post() may be interrupted between the wake step and
  the clearing of has_waiters. It will then write into the has_waiters flag in
  userspace after being preempted for some unknown amount of time.
  
  Approved by:	vangyzen (mentor)
  Sponsored by:	Dell Inc.

Modified:
  stable/11/sys/kern/kern_umtx.c
Directory Properties:
  stable/11/   (props changed)

Changes in other areas also in this revision:
Modified:
  stable/10/sys/kern/kern_umtx.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/11/sys/kern/kern_umtx.c
==============================================================================
--- stable/11/sys/kern/kern_umtx.c	Tue Aug 30 13:26:00 2016	(r305062)
+++ stable/11/sys/kern/kern_umtx.c	Tue Aug 30 13:39:42 2016	(r305063)
@@ -3123,7 +3123,6 @@ do_sem_wake(struct thread *td, struct _u
 	umtxq_busy(&key);
 	cnt = umtxq_count(&key);
 	if (cnt > 0) {
-		umtxq_signal(&key, 1);
 		/*
 		 * Check if count is greater than 0, this means the memory is
 		 * still being referenced by user code, so we can safely
@@ -3136,6 +3135,7 @@ do_sem_wake(struct thread *td, struct _u
 			if (error == -1)
 				error = EFAULT;
 		}
+		umtxq_signal(&key, 1);
 	}
 	umtxq_unbusy(&key);
 	umtxq_unlock(&key);
@@ -3235,8 +3235,6 @@ do_sem2_wake(struct thread *td, struct _
 	umtxq_busy(&key);
 	cnt = umtxq_count(&key);
 	if (cnt > 0) {
-		umtxq_signal(&key, 1);
-
 		/*
 		 * If this was the last sleeping thread, clear the waiters
 		 * flag in _count.
@@ -3251,6 +3249,8 @@ do_sem2_wake(struct thread *td, struct _
 				error = EFAULT;
 			umtxq_lock(&key);
 		}
+
+		umtxq_signal(&key, 1);
 	}
 	umtxq_unbusy(&key);
 	umtxq_unlock(&key);