diff options
author | markj <markj@FreeBSD.org> | 2016-01-09 01:56:46 +0000 |
---|---|---|
committer | markj <markj@FreeBSD.org> | 2016-01-09 01:56:46 +0000 |
commit | e38d62e90de5adf82f18a626067916711d8f233d (patch) | |
tree | f32fa1b0a9db03f6940f0fa00eaae32f3c3a6e34 /contrib/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp | |
parent | eeaf13194e3082c4eb14ec2a9caa050ec6d4d844 (diff) | |
download | FreeBSD-src-e38d62e90de5adf82f18a626067916711d8f233d.zip FreeBSD-src-e38d62e90de5adf82f18a626067916711d8f233d.tar.gz |
Prevent cv_waiters wraparound.
r282971 attempted to fix this problem by decrementing cv_waiters after
waking up from sleeping on a condition variable, but this can result in
a use-after-free if the CV is freed before all woken threads have had a
chance to run. Instead, avoid incrementing cv_waiters past INT_MAX, and
have cv_signal() explicitly check for sleeping threads once cv_waiters has
reached this bound.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: EMC / Isilon Storage Division
Differential Revision: https://reviews.freebsd.org/D4822
Diffstat (limited to 'contrib/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp')
0 files changed, 0 insertions, 0 deletions