diff options
| author | Roman Arutyunyan <arut@nginx.com> | 2015-02-04 16:22:43 +0300 |
|---|---|---|
| committer | Roman Arutyunyan <arut@nginx.com> | 2015-02-04 16:22:43 +0300 |
| commit | 2bae4205abd1583a5f3e2dfdc3174c1ef0c3828d (patch) | |
| tree | 7d0ba5fc446c4e174e7bbead2f4cae063d26e507 | |
| parent | cae1b5d63a6da625cf5c3606d989a7fe2ebfbd4c (diff) | |
| download | nginx-2bae4205abd1583a5f3e2dfdc3174c1ef0c3828d.tar.gz nginx-2bae4205abd1583a5f3e2dfdc3174c1ef0c3828d.zip | |
Core: fixed a race resulting in extra sem_post()'s.
The mtx->wait counter was not decremented if we were able to obtain the lock
right after incrementing it. This resulted in unneeded sem_post() calls,
eventually leading to EOVERFLOW errors being logged, "sem_post() failed
while wake shmtx (75: Value too large for defined data type)".
To close the race, mtx->wait is now decremented if we obtain the lock right
after incrementing it in ngx_shmtx_lock(). The result can become -1 if a
concurrent ngx_shmtx_unlock() decrements mtx->wait before the added code does.
However, that only leads to one extra iteration in the next call of
ngx_shmtx_lock().
| -rw-r--r-- | src/core/ngx_shmtx.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/core/ngx_shmtx.c b/src/core/ngx_shmtx.c index a62999f33..6230dc060 100644 --- a/src/core/ngx_shmtx.c +++ b/src/core/ngx_shmtx.c @@ -101,6 +101,7 @@ ngx_shmtx_lock(ngx_shmtx_t *mtx) (void) ngx_atomic_fetch_add(mtx->wait, 1); if (*mtx->lock == 0 && ngx_atomic_cmp_set(mtx->lock, 0, ngx_pid)) { + (void) ngx_atomic_fetch_add(mtx->wait, -1); return; } @@ -174,7 +175,7 @@ ngx_shmtx_wakeup(ngx_shmtx_t *mtx) wait = *mtx->wait; - if (wait == 0) { + if ((ngx_atomic_int_t) wait <= 0) { return; } |