From patchwork Thu Aug 14 09:31:38 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Barnab=C3=A1s_P=C5=91cze?= X-Patchwork-Id: 24102 Return-Path: X-Original-To: parsemail@patchwork.libcamera.org Delivered-To: parsemail@patchwork.libcamera.org Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com [92.243.16.209]) by patchwork.libcamera.org (Postfix) with ESMTPS id 5FFA7BDCC1 for ; Thu, 14 Aug 2025 09:31:44 +0000 (UTC) Received: from lancelot.ideasonboard.com (localhost [IPv6:::1]) by lancelot.ideasonboard.com (Postfix) with ESMTP id 0B8196924F; Thu, 14 Aug 2025 11:31:43 +0200 (CEST) Authentication-Results: lancelot.ideasonboard.com; dkim=pass (1024-bit key; unprotected) header.d=ideasonboard.com header.i=@ideasonboard.com header.b="S/FOyU83"; dkim-atps=neutral Received: from perceval.ideasonboard.com (perceval.ideasonboard.com [213.167.242.64]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id E219861436 for ; Thu, 14 Aug 2025 11:31:41 +0200 (CEST) Received: from pb-laptop.local (185.221.141.188.nat.pool.zt.hu [185.221.141.188]) by perceval.ideasonboard.com (Postfix) with ESMTPSA id A335B83D for ; Thu, 14 Aug 2025 11:30:47 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com; s=mail; t=1755163847; bh=I0/DirPIgO38PUMSqdQ03zf+CJIFSEKX1wvPLrmXlgw=; h=From:To:Subject:Date:From; b=S/FOyU83ocvAjLlKbRYKmuY5nMRpXZFpEhxp8SmOOTcqg+949P6a8T84RoSbyJ8AF VgvpZnVIlQ87PyQQs3fQgtIOBdnU0pzMBwp8G3RGej7yH+bGYYE7xjcUsQK4PBL/07 BSzrE833WCP2DiSuPPao3FkSckKgDLALqe4uXhzM= From: =?utf-8?q?Barnab=C3=A1s_P=C5=91cze?= To: libcamera-devel@lists.libcamera.org Subject: [PATCH v1] libcamera: base: semaphore: Do not unlock prematurely Date: Thu, 14 Aug 2025 11:31:38 +0200 Message-ID: <20250814093138.2075098-1-barnabas.pocze@ideasonboard.com> X-Mailer: git-send-email 2.50.1 MIME-Version: 1.0 X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libcamera-devel-bounces@lists.libcamera.org Sender: "libcamera-devel" In `Semaphore::release()`, unlocking the mutex before signalling the condition variable can be problematic, especially with "temporary" objects such as the ones `BoundMethodBase::activatePack()` uses to handle `ConnectionTypeBlocking`. Specifically, `Semaphore::acquire()` might lock the mutex after `Semaphore::release()` has unlocked it, but before it had the chance to notify the condition variable. In that case `Semaphore::acquire()` can succeed, and execution may proceed to destroy the `Semaphore` object while the other thread is in the process of running `std::condition_variable::notify_all()`. See [0] for essentially the same issue in libcxx and its fix at [1]. [0]: https://github.com/llvm/llvm-project/issues/23667 [1]: https://github.com/llvm/llvm-project/commit/b3ec43d78aa2599e1592392844a7ec638fab7902 Bug: https://bugs.libcamera.org/show_bug.cgi?id=225 Signed-off-by: Barnabás Pőcze Reviewed-by: Laurent Pinchart Reviewed-by: Kieran Bingham --- src/libcamera/base/semaphore.cpp | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/libcamera/base/semaphore.cpp b/src/libcamera/base/semaphore.cpp index 862f3b313..6aec8b92d 100644 --- a/src/libcamera/base/semaphore.cpp +++ b/src/libcamera/base/semaphore.cpp @@ -93,11 +93,9 @@ bool Semaphore::tryAcquire(unsigned int n) */ void Semaphore::release(unsigned int n) { - { - MutexLocker locker(mutex_); - available_ += n; - } + MutexLocker locker(mutex_); + available_ += n; cv_.notify_all(); }