diff options
| author | Roman Arutyunyan <arut@nginx.com> | 2015-02-04 16:22:43 +0300 |
|---|---|---|
| committer | Roman Arutyunyan <arut@nginx.com> | 2015-02-04 16:22:43 +0300 |
| commit | 06d72320ff5d5cd717b576920bc27c3e26329774 (patch) | |
| tree | bf147e552ab2e14606ee828464a7207c28b7a127 /src | |
| parent | cb451bd6a46dd4b3053bc4ec2f667d4970c41665 (diff) | |
| download | nginx-06d72320ff5d5cd717b576920bc27c3e26329774.tar.gz nginx-06d72320ff5d5cd717b576920bc27c3e26329774.tar.bz2 | |
Core: fixed a race resulting in extra sem_post()'s.
The mtx->wait counter was not decremented if we were able to obtain the lock
right after incrementing it. This resulted in unneeded sem_post() calls,
eventually leading to EOVERFLOW errors being logged, "sem_post() failed
while wake shmtx (75: Value too large for defined data type)".
To close the race, mtx->wait is now decremented if we obtain the lock right
after incrementing it in ngx_shmtx_lock(). The result can become -1 if a
concurrent ngx_shmtx_unlock() decrements mtx->wait before the added code does.
However, that only leads to one extra iteration in the next call of
ngx_shmtx_lock().
Diffstat (limited to 'src')
| -rw-r--r-- | src/core/ngx_shmtx.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/core/ngx_shmtx.c b/src/core/ngx_shmtx.c index a62999f33..6230dc060 100644 --- a/src/core/ngx_shmtx.c +++ b/src/core/ngx_shmtx.c @@ -101,6 +101,7 @@ ngx_shmtx_lock(ngx_shmtx_t *mtx) (void) ngx_atomic_fetch_add(mtx->wait, 1); if (*mtx->lock == 0 && ngx_atomic_cmp_set(mtx->lock, 0, ngx_pid)) { + (void) ngx_atomic_fetch_add(mtx->wait, -1); return; } @@ -174,7 +175,7 @@ ngx_shmtx_wakeup(ngx_shmtx_t *mtx) wait = *mtx->wait; - if (wait == 0) { + if ((ngx_atomic_int_t) wait <= 0) { return; } |