[{"id":3152,"web_url":"https://patchwork.libcamera.org/comment/3152/","msgid":"<20191127145834.GE12879@bigcity.dyn.berto.se>","date":"2019-11-27T14:58:34","subject":"Re: [libcamera-devel] [PATCH] libcamera: thread: Fix locking when\n\tmoving object","submitter":{"id":5,"url":"https://patchwork.libcamera.org/api/people/5/","name":"Niklas Söderlund","email":"niklas.soderlund@ragnatech.se"},"content":"Hi Laurent,\n\nThanks for your patch.\n\nOn 2019-11-24 02:39:17 +0200, Laurent Pinchart wrote:\n> When moving an Object to a Thread, messages posted for the object are\n> move to the target thread's message queue. This requires locking the\n> message queues of the current and target threads, as the target thread\n> may (and is usually) running. The implementation is faulty as it locks\n> the thread data instead of the message queue. This creates a race\n> condition with a tiny but exploitable time window.\n> \n> The issue was noticed by the event-thread test rarely but reproducibly\n> failing with the following assertion error:\n> \n> [1:39:33.850878042]FATAL default thread.cpp:440 assertion \"data_ == receiver->thread()->data_\" failed\n> \n> The issue only occurred when libcamera was compiled in release mode,\n> further hinting of a race condition.\n> \n> Fixes: 01b930964acd (\"libcamera: thread: Add a messaging passing API\")\n> Signed-off-by: Laurent Pinchart \n\nReviewed-by: Niklas Söderlund \n\n> ---\n> src/libcamera/thread.cpp | 4 ++--\n> 1 file changed, 2 insertions(+), 2 deletions(-)\n> \n> diff --git a/src/libcamera/thread.cpp b/src/libcamera/thread.cpp\n> index e152af14631e..029a0e8fddd5 100644\n> --- a/src/libcamera/thread.cpp\n> +++ b/src/libcamera/thread.cpp\n> @@ -456,8 +456,8 @@ void Thread::moveObject(Object *object)\n> \tThreadData *currentData = object->thread_->data_;\n> \tThreadData *targetData = data_;\n> \n> -\tMutexLocker lockerFrom(currentData->mutex_, std::defer_lock);\n> -\tMutexLocker lockerTo(targetData->mutex_, std::defer_lock);\n> +\tMutexLocker lockerFrom(currentData->messages_.mutex_, std::defer_lock);\n> +\tMutexLocker lockerTo(targetData->messages_.mutex_, std::defer_lock);\n> \tstd::lock(lockerFrom, lockerTo);\n> \n> \tmoveObject(object, currentData, targetData);\n> -- \n> Regards,\n> \n> Laurent Pinchart\n> \n> _______________________________________________\n> libcamera-devel mailing list\n> libcamera-devel@lists.libcamera.org\n> https://lists.libcamera.org/listinfo/libcamera-devel","headers":{"Return-Path":"","Received":["from mail-lj1-x241.google.com (mail-lj1-x241.google.com\n\t[IPv6:2a00:1450:4864:20::241])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 762FF60C33\n\tfor ;\n\tWed, 27 Nov 2019 15:58:36 +0100 (CET)","by mail-lj1-x241.google.com with SMTP id m4so24802390ljj.8\n\tfor ;\n\tWed, 27 Nov 2019 06:58:36 -0800 (PST)","from localhost (h-93-159.A463.priv.bahnhof.se. [46.59.93.159])\n\tby smtp.gmail.com with ESMTPSA id\n\tr4sm7193568ljn.64.2019.11.27.06.58.34\n\t(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n\tWed, 27 Nov 2019 06:58:34 -0800 (PST)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=ragnatech-se.20150623.gappssmtp.com; s=20150623;\n\th=date:from:to:cc:subject:message-id:references:mime-version\n\t:content-disposition:content-transfer-encoding:in-reply-to\n\t:user-agent; bh=6UB9oHa6VDSXRXanreiBGQNk+MlHgWoS+AFNBhBcGC8=;\n\tb=EXsppMB7iHGfz3fjZSEujdgiQsXdRSYFwSuCa3k7UOqJRQTgG/ykZsh69F7+FplPjx\n\tfABXl52GZ170m1ueizlmIRnI68mu1t/I/mBXdlHfOemuBvWCQTvY5bfQg2i6Z5M6TbvT\n\tnWIcmuAfTKqNmh8qq37Uz0RiK00jXOT8GwT34cFvciUkXevpjbAmmetPhd1w1pz0/XAT\n\tilxvYf11mJeV96qloY7a3K1Ejuuyi9wgP5AAi65AKl9BVXVsRPVQmwyta+6LbXgJv0eQ\n\tsQ8SwWvScNanPoIyBW1woQYpkCew5HJGxc0tgS9tkLiAyGeUFZuf/SjLtvFPRZE5FU3o\n\trfXg==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:date:from:to:cc:subject:message-id:references\n\t:mime-version:content-disposition:content-transfer-encoding\n\t:in-reply-to:user-agent;\n\tbh=6UB9oHa6VDSXRXanreiBGQNk+MlHgWoS+AFNBhBcGC8=;\n\tb=GU+IDhlzUms8cYI0umCmE9jKzeQg/1jWWU5wYwjg2d48N7nELbWJwg+wej0JSvmn9/\n\tqZt3E/LIaL+EdEx6SCX7Qp2tXp2RPwb63IRjkPR/3qtOCAzbCEBUQl2jvFRcy9QcNjHW\n\tSUNFAmUbSzeBdHLCK93+oxJAamVAgY3d2tMtd+p1YMdGctaTuRtht/XV3CxPimB2Io4w\n\tW4IFtHTF9e/qMOTYanXGPCdEdzU8XEjw76ty9gaomufu4U/x/vS6LhCLH7UKumgyQVjB\n\tTvFzJuqUQXbEQZomIpUBbDvpVWTGZ3dXAsBn7+MOlVOlbdfqqCSEPX7erNG4AtkQrpbd\n\t5pxA==","X-Gm-Message-State":"APjAAAUeCDpl3RJhVftQI3lmeN4zdCQI7QPD92crQFsrMFvKB97YmN3s\n\tEnoXC8Vt4VRatXGuki8pOkd+e3vung8pUg==","X-Google-Smtp-Source":"APXvYqzXwvNM3SAXI3jlxRxD9sbFMZ0pN90/6NV/YzwZtVdemMeYLwBEk3kO31X/V+1eS226DILoAg==","X-Received":"by 2002:a2e:7204:: with SMTP id\n\tn4mr29702004ljc.139.1574866715600; \n\tWed, 27 Nov 2019 06:58:35 -0800 (PST)","Date":"Wed, 27 Nov 2019 15:58:34 +0100","From":"Niklas =?iso-8859-1?q?S=F6derlund?= ","To":"Laurent Pinchart ","Cc":"libcamera-devel@lists.libcamera.org","Message-ID":"<20191127145834.GE12879@bigcity.dyn.berto.se>","References":"<20191124003917.10887-1-laurent.pinchart@ideasonboard.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=iso-8859-1","Content-Disposition":"inline","Content-Transfer-Encoding":"8bit","In-Reply-To":"<20191124003917.10887-1-laurent.pinchart@ideasonboard.com>","User-Agent":"Mutt/1.12.1 (2019-06-15)","Subject":"Re: [libcamera-devel] [PATCH] libcamera: thread: Fix locking when\n\tmoving object","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","X-List-Received-Date":"Wed, 27 Nov 2019 14:58:36 -0000"}}]