net/unix : possible race bug at unix_create1()

From: 홍신 shin hong <hidden>
Date: 2009-08-12 15:00:22

Hi. I am reporting a possible race bug at unix_create1()
in net/unix/af_unix.c of Linux 2.6.30.4.

Concurrent executions of unix_create1() function
in two different threads may result race condition
when unix_nr_socks +1 == 2 * get_max_files().

It is possible that no thread can pass the if-condition
checking if two atomic_inc() operations are executed
before.

It seems that it would be better to combine two
atomic operations into one atomic_inc_and_return().

Please examine the code and let me know your opinion.

Thank you

Sincerely
Shin Hong
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help