diff options
| -rw-r--r-- | winsup/cygwin/release/3.1.0 | 3 | ||||
| -rw-r--r-- | winsup/cygwin/timerfd.cc | 24 | ||||
| -rw-r--r-- | winsup/cygwin/timerfd.h | 2 |
3 files changed, 28 insertions, 1 deletions
diff --git a/winsup/cygwin/release/3.1.0 b/winsup/cygwin/release/3.1.0 index a2bdc8f3c..e8144d4d0 100644 --- a/winsup/cygwin/release/3.1.0 +++ b/winsup/cygwin/release/3.1.0 @@ -34,3 +34,6 @@ Bug Fixes - Define missing MSG_EOR. It's unsupported by the underlying Winsock layer so using it in send(2), sendto(2), or sendmsg(2) will return -1 with errno set to EOPNOTSUPP and recvmsg(2) will never return it. + +- Fix a race condition in the timerfd code. + Addresses: https://cygwin.com/ml/cygwin/2019-06/msg00096.html diff --git a/winsup/cygwin/timerfd.cc b/winsup/cygwin/timerfd.cc index 8e4c94e66..f1a4c2804 100644 --- a/winsup/cygwin/timerfd.cc +++ b/winsup/cygwin/timerfd.cc @@ -89,6 +89,25 @@ timerfd_tracker::handle_timechange_window () } } +/* Like enter_critical_section, but returns -1 on a cancel event. */ +int +timerfd_tracker::enter_critical_section_cancelable () +{ + HANDLE w[2] = { cancel_evt, _access_mtx }; + DWORD waitret = WaitForMultipleObjects (2, w, FALSE, INFINITE); + + switch (waitret) + { + case WAIT_OBJECT_0: + return -1; + case WAIT_OBJECT_0 + 1: + case WAIT_ABANDONED_0 + 1: + return 1; + default: + return 0; + } +} + DWORD timerfd_tracker::thread_func () { @@ -137,7 +156,10 @@ timerfd_tracker::thread_func () continue; } - if (!enter_critical_section ()) + int ec = enter_critical_section_cancelable (); + if (ec < 0) + goto canceled; + else if (!ec) continue; /* Make sure we haven't been abandoned and/or disarmed in the meantime */ diff --git a/winsup/cygwin/timerfd.h b/winsup/cygwin/timerfd.h index 154be0847..80688e79e 100644 --- a/winsup/cygwin/timerfd.h +++ b/winsup/cygwin/timerfd.h @@ -86,6 +86,8 @@ class timerfd_tracker /* cygheap! */ return (WaitForSingleObject (_access_mtx, INFINITE) & ~WAIT_ABANDONED_0) == WAIT_OBJECT_0; } + /* A version that honors a cancel event, for use in thread_func. */ + int enter_critical_section_cancelable (); void leave_critical_section () { ReleaseMutex (_access_mtx); |