DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2329

Lost-wakeup race in ppb_request_bus() can permanently hang a process opening a parallel port device

Summary

ppb_request_bus() checks ppb_owner inside crit section then exits crit section BEFORE calling tsleep(). On SMP another CPU can call ppb_release_bus() (sets ppb_owner=0 calls wakeup(ppb)) in window between crit_exit() and tsleep(). Wakeup delivered to thread not yet slept so lost. Requesting thread calls tsleep with timo=0 (infinite) hangs forever. With PPB_WAIT|PPB_NOINTR uninterruptible permanent hang open() never returns. PPB_WAIT|PPB_NOINTR path not interruptible by signals kill -9 cannot terminate.

Discussion (0)

No comments yet.