> On Sat, Apr 12, 2008 at 9:53 PM, Roland Dreier <rdreier@cisco.com> wrote:
> > Just make sure you don't forget the history of completions... As
> > Linus said long ago (
http://lwn.net/2001/0802/a/lt-completions.php3):
> >
> > In case anybody cares, the race was that Linux semaphores only protect the
> > accesses _inside_ the semaphore, while the accesses by the semaphores
> > themselves can "race" in the internal implementation. That helps make an
> > efficient implementation, but it means that the race was:
> >
> > cpu #1 cpu #2
> >
> > DECLARE_MUTEX_LOCKED(sem);
> > ..
> > down(&sem); up(&sem);
> > return;
> > wake_up(&sem.wait) /*BOOM*/
>
> Thanks for bringing this back to attention -- I wasn't aware of the
> message you cited.
>
> My opinion about the above race is that this race has nothing to do
> with the semaphore concept, but that the race is caused by the way in
> which the semaphore object is used. Using any object after it has been
> destroyed is asking for trouble.