rcore-thread icon indicating copy to clipboard operation
rcore-thread copied to clipboard

thread_pool: possible deadlocks

Open Chain-Fox opened this issue 5 years ago • 0 comments

There are two possible deadlock bugs in threadpool.rs

  1. Double-Lock:
  • In fn tick: https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L93-L97 https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L159 The first lock self.timer.lock() is on L93 fn set_status is on L97 The second lock is on L159

  • In fn set_status: https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L151-L152 https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L169 https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L236 https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L217 The first lock self.threads[tid].lock() is on L152 fn exit_handler is on L169 fn wakeup is on L236 The second lock is on L217

  • In fn stop: https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L126-L127 https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L134 The first lock self.threads[tid].lock() is on L127 fn exit_handler is L134 fn wakeup is on L236 The second lock is on L217

  1. Locks in conflicting orders:
  • self.threads[tid].lock()->self.timer.lock() https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L151-L152 https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L159 L152->L159

  • self.timer.lock()->self.threads[tid].lock() L93->L152, L93->L217

A possible fix is to add a new version of set_status() and pass &mut MutexGuard from self.timer.lock() as a parameter to replace the original one on L159.

Chain-Fox avatar Jun 28 '20 04:06 Chain-Fox