net/unix : possible race bug at unix_create1()
From: 홍신 shin hong <hidden>
Date: 2009-08-12 15:00:22
From: 홍신 shin hong <hidden>
Date: 2009-08-12 15:00:22
Hi. I am reporting a possible race bug at unix_create1() in net/unix/af_unix.c of Linux 2.6.30.4. Concurrent executions of unix_create1() function in two different threads may result race condition when unix_nr_socks +1 == 2 * get_max_files(). It is possible that no thread can pass the if-condition checking if two atomic_inc() operations are executed before. It seems that it would be better to combine two atomic operations into one atomic_inc_and_return(). Please examine the code and let me know your opinion. Thank you Sincerely Shin Hong