tree b4966f40e2e6cb0f5fca9b104bb9f0318f478d17
parent 27167b98babab9cc70b97ed3b0ae8a63378c14f7
author Phillip Lougher <phillip@squashfs.org.uk> 1411000091 +0100
committer Phillip Lougher <phillip@squashfs.org.uk> 1411000091 +0100

mksquashfs: fix rare race in fragment waiting in filesystem finalisation

Fix a rare race condition in fragment waiting when finalising the
filesystem.  This is a race condition that was initially fixed in 2009,
but inadvertantly re-introduced in the latest release when the code
was rewritten.

Background:

When finalising the filesystem, the main control thread needs to ensure
all the in-flight fragments have been queued to the writer thread before
asking the writer thread to finish, and then writing the metadata.

It does this by waiting on the fragments_outstanding counter.  Once this
counter reaches 0, it synchronises with the writer thread, waiting until
the writer thread reports no outstanding data to be written.

However, the main thread can race with the fragment deflator thread(s)
because the fragment deflator thread(s) decrement the fragments_outstanding
counter and release the mutex before queueing the compressed fragment
to the writer thread, i.e. the offending code is:

                        fragments_outstanding --;
                        pthread_mutex_unlock(&fragment_mutex);
                        queue_put(to_writer, write_buffer);

In extremely rare circumstances, the main thread may see the
fragments_outstanding counter is zero before the fragment
deflator sends the fragment buffer to the writer thread, and synchronise
with the writer thread, and finalise before the fragment has been written.

The fix is to ensure the fragment is queued to the writer thread
before releasing the mutex.

Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>