Project

General

Profile

Actions

Bug #3531

closed

Race between log_sysevent_filename() and log_event_upcall() can cause panic

Added by Marcel Telka over 9 years ago. Updated almost 7 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
kernel
Start date:
2013-02-06
Due date:
% Done:

100%

Estimated time:
Difficulty:
Medium
Tags:
Gerrit CR:

Description

If the log_sysevent_filename() and log_event_upcall() are running concurrently it can cause several issues:
- two threads can call the door_ki_rele(event_door) in parallel - Root Cause 1 (panic)
- the event_door is cleared out before it is referenced - Root Cause 2 (panic)
- the logevent_door_upcall_filename is used after it is freed - Root Cause 3 (use-after-free)

Solution:
Added event_door_mutex into log_sysevent_filename() and log_event_upcall() to prevent the race.

Actions

Also available in: Atom PDF