diff options
author | Konstantin Belousov <kib@FreeBSD.org> | 2012-09-22 12:17:09 +0000 |
---|---|---|
committer | Konstantin Belousov <kib@FreeBSD.org> | 2012-09-22 12:17:09 +0000 |
commit | 787a64ddd279aa5b35f1ee9956345e0217515049 (patch) | |
tree | 9b4579e4aa58e7711d09fe0c5ab0307425da060c /sys/kern/kern_thread.c | |
parent | 29bdd62c85c2b9e28df4dca300caa8a769d6b0bf (diff) | |
download | src-787a64ddd279aa5b35f1ee9956345e0217515049.tar.gz src-787a64ddd279aa5b35f1ee9956345e0217515049.zip |
Do not skip two elements of the tid_buffer when reusing the buffer
slot. This eventually results in exhaustion of the tid space, causing
new threads get tid -1 as identifier.
The bad effect of having the thread id equal to -1 is that
UMTX_OP_UMUTEX_WAIT returns EFAULT for a lock owned by such thread,
because casuword cannot distinguish between literal value -1 read from
the address and -1 returned as an indication of faulted
access. _thr_umutex_lock() helper from libthr does not check for
errors from _umtx_op_err(2), causing an infinite loop in
mutex_lock_sleep().
We observed the JVM processes hanging and consuming enormous amount of
system time on machines with approximately 100 days uptime.
Reported by: Mykola Dzham <freebsd levsha org ua>
MFC after: 1 week
Notes
Notes:
svn path=/head/; revision=240813
Diffstat (limited to 'sys/kern/kern_thread.c')
-rw-r--r-- | sys/kern/kern_thread.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/kern/kern_thread.c b/sys/kern/kern_thread.c index 7c21644df754..9d92447e2783 100644 --- a/sys/kern/kern_thread.c +++ b/sys/kern/kern_thread.c @@ -116,7 +116,7 @@ tid_free(lwpid_t tid) mtx_lock(&tid_lock); if ((tid_tail + 1) % TID_BUFFER_SIZE == tid_head) { tmp_tid = tid_buffer[tid_head++]; - tid_head = (tid_head + 1) % TID_BUFFER_SIZE; + tid_head %= TID_BUFFER_SIZE; } tid_buffer[tid_tail++] = tid; tid_tail %= TID_BUFFER_SIZE; |