Alfred Perlstein 435cdf88ea Fix a race where timeout/untimeout could cause crashes for Giant locked ... code. The bug: There exists a race condition for timeout/untimeout(9) due to the way that the softclock thread dequeues timeouts. The softclock thread sets the c_func and c_arg of the callout to NULL while holding the callout lock but not Giant. It then drops the callout lock and acquires Giant. It is at this point where untimeout(9) on another cpu/thread could be called. Since c_arg and c_func are cleared, untimeout(9) does not touch the callout and returns as if the callout is canceled. The softclock then tries to acquire Giant and likely blocks due to the other cpu/thread holding it. The other cpu/thread then likely deallocates the backing store that c_arg points to and finishes working and hence drops Giant. Softclock resumes and acquires giant and calls the function with the now free'd c_arg and we have corruption/crash. The fix: We need to track curr_callout even for timeout(9) (LOCAL_ALLOC) callouts. We need to free the callout after the softclock processes it to deal with the race here. Obtained from: Juniper Networks, iedowse Reviewed by: jhb, iedowse MFC After: 2 weeks.		2008-03-22 07:29:45 +00:00
..
amd64	Explicitly use spinlock_enter/exit rather than locking the icu_lock spin	2008-03-20 21:53:27 +00:00
arm	add usb devices and more wlan stuff now that usb is functional	2008-03-20 17:44:58 +00:00
boot	style(9) & style.Makefile(9)	2008-03-13 17:54:21 +00:00
bsm
cam	Locking in the ses_ioctl handler doesn't have to be so strict because	2008-03-17 17:18:16 +00:00
cddl	In keeping with style(9)'s recommendations on macros, use a ';'	2008-03-16 10:58:09 +00:00
compat	o Add stub support for some new futex operations,	2008-03-20 17:03:55 +00:00
conf	- Restore runq to manipulating threads directly by putting runq links and	2008-03-20 05:51:16 +00:00
contrib	In keeping with style(9)'s recommendations on macros, use a ';'	2008-03-16 10:58:09 +00:00
crypto
ddb
dev	Add in a compat. mode so you can either open the card's device	2008-03-22 02:57:49 +00:00
fs	Do not dereference cdev->si_cdevsw, use the dev_refthread() to properly	2008-03-20 16:08:42 +00:00
gdb	Commit SYSINIT() ;-adding patch missed in previous pass.	2008-03-16 13:02:04 +00:00
geom	- Fix a memory leak when re-discovering a gvinum configuration.	2008-03-18 08:48:51 +00:00
gnu
i4b
i386	Explicitly use spinlock_enter/exit rather than locking the icu_lock spin	2008-03-20 21:53:27 +00:00
ia64	Simplify the interrupt code a bit:	2008-03-17 22:42:01 +00:00
isa
kern	Fix a race where timeout/untimeout could cause crashes for Giant locked	2008-03-22 07:29:45 +00:00
libkern
modules
net	back out last change as Sam believes that it breaks multicast - need to revisit after following up with pyun	2008-03-20 06:19:34 +00:00
net80211
netatalk
netatm	In keeping with style(9)'s recommendations on macros, use a ';'	2008-03-16 10:58:09 +00:00
netgraph	Remove impossible (hk_peer == NULL) check from ng_address_hook().	2008-03-16 23:12:17 +00:00
netinet	Explicitate the newpacket size.	2008-03-19 11:28:13 +00:00
netinet6	Correct IPsec behaviour with a 'use' level in SP but no SA available.	2008-03-14 16:38:11 +00:00
netipsec	Add ';' missed with the SYSINIT changes.	2008-03-21 18:31:42 +00:00
netipx
netnatm
netncp
netsmb
nfs
nfs4client
nfsclient	In keeping with style(9)'s recommendations on macros, use a ';'	2008-03-16 10:58:09 +00:00
nfsserver	Fix a regression from the last revision - don't edit the ns_rec list while	2008-03-19 12:33:25 +00:00
opencrypto
pc98	In keeping with style(9)'s recommendations on macros, use a ';'	2008-03-16 10:58:09 +00:00
pccard
pci
powerpc	Simplify the interrupt code a bit:	2008-03-17 22:42:01 +00:00
rpc
security	In keeping with style(9)'s recommendations on macros, use a ';'	2008-03-16 10:58:09 +00:00
sparc64	Oops. Use atomic_add_long() for atomic_fetchadd_long() (not atomic_add_int())	2008-03-19 07:27:24 +00:00
sun4v	Oops. Use atomic_add_long() for atomic_fetchadd_long() (not atomic_add_int())	2008-03-19 07:27:24 +00:00
sys	- Add a new td flag TDF_NEEDSUSPCHK that is set whenever a thread needs	2008-03-21 08:23:25 +00:00
tools
ufs	Reduce the acquisition of the vnode interlock in the ffs_read() and	2008-03-21 12:33:00 +00:00
vm	Do not dereference cdev->si_cdevsw, use the dev_refthread() to properly	2008-03-20 16:08:42 +00:00
Makefile