Skip to content

Fix race condition in futex-based QSemaphore

Add one and reset the wakeAll bit atomically.

This avoids a race in a case where an acquiring thread is owning the semaphore, and deleting it after a set number of releases (one for each thread referencing the semaphore).

Two releasing threads could enter the if statement under futexNeedsWake(prevValue), the counter been incremented at this point and reached the value being acquired, meaning the thread acquiring can be awakened by just one of the two releasers, delete the semaphore, and then the second releaser would access the now deleted semaphore.

The patch avoids that by unsetting and reading the wakeAll bit atomically, so only one thread will try to wake all threads.

Pick-to: 6.3 6.2 5.15 Fixes: QTBUG-102484 Change-Id: I32172ed44d74378c627918e19b9e1aaadb5c6d1d Reviewed-by: Thiago Macieira thiago.macieira@intel.com (cherry picked from commit 830b1550)

Merge request reports