mirrors/Zag
1
0
Fork 0
mirror of https://github.com/rdmsr/zag.git synced 2026-10-31 23:38:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

ke/mutex: fix possible use-after-free

Browse Source 
A thread might get reaped between loading the owner and its state,
leading to a possible use-after-free.
This commit is contained in:
Loïc Grégoire
2026-07-08 11:15:31 -04:00
parent 898ceb171e
commit 5fbc61ecb1
1 changed files with 8 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/kern/mutex.zig
+8 -14
View File
@@ -29,21 +29,15 @@ pub const Mutex = struct {
return; return;
} }
// Fast path: if the owner is running, try to acquire without a turnstile by spinning a bit. // Fast path: Try to acquire without a turnstile by spinning a bit.
if (cur_owner.?.?.state.load(.monotonic) == .Running) { for (0..optimistic_spins) |_| {
for (0..optimistic_spins) |_| { if (m.owner.cmpxchgWeak(null, curtd, .acquire, .monotonic) != null) {
if (m.owner.cmpxchgStrong(null, curtd, .acquire, .monotonic)) |maybe_owner| { std.atomic.spinLoopHint();
const owner = maybe_owner.?; continue;
if (owner.state.load(.monotonic) != .Running) break;
std.atomic.spinLoopHint();
continue;
}
ke.ipl.lower(ipl);
return;
} }
ke.ipl.lower(ipl);
return;
} }
// Slow path: contended, block on a turnstile. // Slow path: contended, block on a turnstile.