Change msleep() and tsleep() to not alter the calling thread's priority

if the specified priority is zero.  This avoids a race where the calling
thread could read a snapshot of it's current priority, then a different
thread could change the first thread's priority, then the original thread
would call sched_prio() inside msleep() undoing the change made by the
second thread.  I used a priority of zero as no thread that calls msleep()
or tsleep() should be specifying a priority of zero anyway.

The various places that passed 'curthread->td_priority' or some variant
as the priority now pass 0.

1 files changed, 3 insertions, 5 deletions

diff --git a/sys/kern/kern_intr.c b/sys/kern/kern_intr.c
index fae8e97..042a0ec 100644
--- a/sys/kern/kern_intr.c
+++ b/sys/kern/kern_intr.c
@@ -373,8 +373,7 @@ intr_event_add_handler(struct intr_event *ie, const char *name,
 	/* Create a thread if we need one. */
 	while (ie->ie_thread == NULL && !(flags & INTR_FAST)) {
 		if (ie->ie_flags & IE_ADDING_THREAD)
-			msleep(ie, &ie->ie_lock, curthread->td_priority,
-			    "ithread", 0);
+			msleep(ie, &ie->ie_lock, 0, "ithread", 0);
 		else {
 			ie->ie_flags |= IE_ADDING_THREAD;
 			mtx_unlock(&ie->ie_lock);
@@ -460,8 +459,7 @@ ok:
 		TAILQ_REMOVE(&ie->ie_handlers, handler, ih_next);
 	mtx_unlock_spin(&sched_lock);
 	while (handler->ih_flags & IH_DEAD)
-		msleep(handler, &ie->ie_lock, curthread->td_priority, "iev_rmh",
-		    0);
+		msleep(handler, &ie->ie_lock, 0, "iev_rmh", 0);
 	intr_event_update(ie);
 #ifdef notyet
 	/*
@@ -685,7 +683,7 @@ ithread_execute_handlers(struct proc *p, struct intr_event *ie)
 			    ie->ie_name);
 			ie->ie_warned = 1;
 		}
-		tsleep(&ie->ie_count, curthread->td_priority, "istorm", 1);
+		tsleep(&ie->ie_count, 0, "istorm", 1);
 	} else
 		ie->ie_count++;