[PATCH] #13594: Avoid race in nscd

[Paul Pluzhnikov]

On Mon, May 14, 2012 at 2:00 PM, Andreas Jaeger <aj@suse.com> wrote:

We've just been hit by this bug. Thanks for the fix!

> On 05/14/2012 10:37 PM, Carlos O'Donell wrote:
>> Is this sufficient to guarantee atomicity? Is it because we use the
>> *_acq sematic atomic that it works?
>
>
> The acq code checks first that the value is 0 - and only then changes it. So
> with setting it to 0 we release the lock.

In reviewing the patch, Richard Smith noted the same problem Carlos did.

Quoting Jeffrey Yasskin:

  The patch is wrong. Among more exotic problems, the compiler could emit
  the 'mov' instruction that stores 0 to the lock before the read from
  map->head->extra_data[NSCD_HST_IDX_CONF_TIMESTAMP], allowing another
  thread to get in and change it.

A release barrier is required here. I'll send a follow patch.

Thanks,
-- 
Paul Pluzhnikov