rcore-thread
rcore-thread copied to clipboard
thread_pool: possible deadlocks
There are two possible deadlock bugs in threadpool.rs
- Double-Lock:
-
In
fn tick: https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L93-L97 https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L159 The first lockself.timer.lock()is on L93fn set_statusis on L97 The second lock is on L159 -
In
fn set_status: https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L151-L152 https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L169 https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L236 https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L217 The first lockself.threads[tid].lock()is on L152fn exit_handleris on L169fn wakeupis on L236 The second lock is on L217 -
In
fn stop: https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L126-L127 https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L134 The first lockself.threads[tid].lock()is on L127fn exit_handleris L134fn wakeupis on L236 The second lock is on L217
- Locks in conflicting orders:
-
self.threads[tid].lock()->self.timer.lock() https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L151-L152 https://github.com/rcore-os/rcore-thread/blob/e00f5ed11479e5436470497ec9ce49510fee94e1/src/thread_pool.rs#L159 L152->L159
-
self.timer.lock()->self.threads[tid].lock() L93->L152, L93->L217
A possible fix is to add a new version of set_status() and pass &mut MutexGuard from self.timer.lock() as a parameter to replace the original one on L159.