[Bug nptl/12674] sem_post/sem_wait race causing sem_post to return EINVAL

["bugdal at aerifal dot cx" <sourceware-bugzilla@sourceware.org>]

http://sourceware.org/bugzilla/show_bug.cgi?id=12674

Rich Felker <bugdal at aerifal dot cx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
                 CC|                            |bugdal at aerifal dot cx
         Resolution|INVALID                     |

--- Comment #7 from Rich Felker <bugdal at aerifal dot cx> 2011-08-07 18:08:55 UTC ---
After reading this bug report and followup comments, I have identified and
fixed the corresponding bug in musl's implementation of POSIX semaphores. The
fix is very easy and the same approach could easily be used to fix glibc/NPTL.
There is not yet a release with the fix, but you can see the commit/diff in our
git repository at:

http://git.etalabs.net/cgi-bin/gitweb.cgi?p=musl;a=commitdiff;h=88c4e720317845a8e01aee03f142ba82674cd23d;hp=88798393cab009ce78fe498051072db71ba9d035

The basic idea is that a waiter stores a flag that it's waiting in the atomic
semaphore value field, in addition to incrementing the waiter count. This way
sem_post can see "old" waiters by examining the waiters count *before*
atomically upping the semaphore value, and can see a "last minute" waiter in
the old semaphore value when it atomically replaces it with compare-and-swap.

The same approach works for fixing the corresponding bug in mutexes and
rwlocks. Note that a similar bug also exists for barriers, and I have a clean
solution for non-process-shared barriers, but no solution for process-shared
barriers that's not subject to failure cases.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.