fix extremely rare but dangerous race condition in robust mutexes

[musl] / src / thread / pthread_barrier_wait.c

diff --git a/src/thread/pthread_barrier_wait.c b/src/thread/pthread_barrier_wait.c
index a97f6d5..5e60338 100644 (file)
--- a/src/thread/pthread_barrier_wait.c
+++ b/src/thread/pthread_barrier_wait.c
@@ -1,58 +1,53 @@
 #include "pthread_impl.h"
 
-static int vmlock[2];
-
-void __vm_lock(int inc)
-{
-       for (;;) {
-               int v = vmlock[0];
-               if (inc*v < 0) __wait(vmlock, vmlock+1, v, 1);
-               else if (a_cas(vmlock, v, v+inc)==v) break;
-       }
-}
-
-void __vm_unlock(void)
-{
-       if (vmlock[0]>0) a_dec(vmlock);
-       else a_inc(vmlock);
-       if (vmlock[1]) __wake(vmlock, 1, 1);
-}
+void __vm_lock_impl(int);
+void __vm_unlock_impl(void);
 
 static int pshared_barrier_wait(pthread_barrier_t *b)
 {
        int limit = (b->_b_limit & INT_MAX) + 1;
-       int seq;
        int ret = 0;
+       int v, w;
 
        if (limit==1) return PTHREAD_BARRIER_SERIAL_THREAD;
 
-       while (a_swap(&b->_b_lock, 1))
-               __wait(&b->_b_lock, &b->_b_waiters, 1, 0);
-
-       seq = b->_b_seq;
+       while ((v=a_cas(&b->_b_lock, 0, limit)))
+               __wait(&b->_b_lock, &b->_b_waiters, v, 0);
 
+       /* Wait for <limit> threads to get to the barrier */
        if (++b->_b_count == limit) {
+               a_store(&b->_b_count, 0);
                ret = PTHREAD_BARRIER_SERIAL_THREAD;
-               b->_b_seq++;
-               __wake(&b->_b_seq, -1, 0);
+               if (b->_b_waiters2) __wake(&b->_b_count, -1, 0);
        } else {
                a_store(&b->_b_lock, 0);
                if (b->_b_waiters) __wake(&b->_b_lock, 1, 0);
-               __wait(&b->_b_seq, 0, seq, 0);
+               while ((v=b->_b_count)>0)
+                       __wait(&b->_b_count, &b->_b_waiters2, v, 0);
        }
 
-       __vm_lock(+1);
+       __vm_lock_impl(+1);
 
-       if (a_fetch_add(&b->_b_count, -1)==1) {
-               b->_b_seq++;
-               __wake(&b->_b_seq, -1, 0);
-               a_store(&b->_b_lock, 0);
-               if (b->_b_waiters) __wake(&b->_b_lock, 1, 0);
+       /* Ensure all threads have a vm lock before proceeding */
+       if (a_fetch_add(&b->_b_count, -1)==1-limit) {
+               a_store(&b->_b_count, 0);
+               if (b->_b_waiters2) __wake(&b->_b_count, -1, 0);
        } else {
-               __wait(&b->_b_seq, 0, seq+1, 0);
+               while ((v=b->_b_count))
+                       __wait(&b->_b_count, &b->_b_waiters2, v, 0);
        }
        
-       __vm_unlock();
+       /* Perform a recursive unlock suitable for self-sync'd destruction */
+       do {
+               v = b->_b_lock;
+               w = b->_b_waiters;
+       } while (a_cas(&b->_b_lock, v, v==INT_MIN+1 ? 0 : v-1) != v);
+
+       /* Wake a thread waiting to reuse or destroy the barrier */
+       if (v==INT_MIN+1 || (v==1 && w))
+               __wake(&b->_b_lock, 1, 0);
+
+       __vm_unlock_impl();
 
        return ret;
 }