diff options
| author | Michał Winiarski <michal.winiarski@intel.com> | 2020-03-31 13:19:11 +0200 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2020-03-31 19:46:13 +0100 |
| commit | 1bcdc9f962201eb6e8e2ef2cde3bfa254029d448 (patch) | |
| tree | 3bf254b2229adde847840fbd2bfc9f4ae19c28d8 /lib/igt_dummyload.h | |
| parent | d9e70dc1b35633b7d5c81cbfa165e331189eb260 (diff) | |
lib/igt_dummyload: Use timerfd rather than SIGEV_THREAD
Since timer_delete doesn't give us any guarantees that the thread and
its notify_function isn't currently running, we can hit a use-after-free
in a race condition scenario.
This causes a seemingly random segfault when igt_spin_end from notify
thread is called after igt_spin_free was already called from the main
thread.
Let's fix that by using timerfd and managing the timer thread ourselves.
Signed-off-by: Michał Winiarski <michal.winiarski@intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Diffstat (limited to 'lib/igt_dummyload.h')
| -rw-r--r-- | lib/igt_dummyload.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/igt_dummyload.h b/lib/igt_dummyload.h index cb696009..dfba123c 100644 --- a/lib/igt_dummyload.h +++ b/lib/igt_dummyload.h @@ -34,7 +34,8 @@ typedef struct igt_spin { unsigned int handle; - timer_t timer; + int timerfd; + pthread_t timer_thread; struct igt_list_head link; uint32_t *condition; |