[ion] 23057: - Fix a serious bug in Kernel Queues. A condition existed where an inserted kernel queue with a timeout would crash the system once the thread waiting on it had its wait aborted or completed. - Thanks a lot to Thomas for his brutal test application which allowed me to discover this bug and the bugs addressed in the previous commits (related to the wait list and thread scheduler list corruption).

Author: ion
Date: Fri Jul 14 06:26:44 2006
New Revision: 23057

URL: http://svn.reactos.org/svn/reactos?rev=23057&view=rev
Log:
- Fix a serious bug in Kernel Queues. A condition existed where an inserted kernel queue
with a timeout would crash the system once the thread waiting on it had its wait aborted
or completed.
- Thanks a lot to Thomas for his brutal test application which allowed me to discover this
bug and the bugs addressed in the previous commits (related to the wait list and thread
scheduler list corruption).

Modified:
    trunk/reactos/ntoskrnl/ke/kthread.c
    trunk/reactos/ntoskrnl/ke/queue.c
    trunk/reactos/ntoskrnl/ke/wait.c

Modified: trunk/reactos/ntoskrnl/ke/kthread.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ke/kthread.c?rev=…
==============================================================================
--- trunk/reactos/ntoskrnl/ke/kthread.c (original)
+++ trunk/reactos/ntoskrnl/ke/kthread.c Fri Jul 14 06:26:44 2006
@@ -764,7 +764,7 @@
     /* Initialize the Suspend Semaphore */
     KeInitializeSemaphore(&Thread->SuspendSemaphore, 0, 128);
 
-    /* FIXME OPTIMIZATION OF DOOM. DO NOT ENABLE FIXME */
+    /* Setup the timer */
     Timer = &Thread->Timer;
     KeInitializeTimer(Timer);
     TimerWaitBlock = &Thread->WaitBlock[TIMER_WAIT_BLOCK];

Modified: trunk/reactos/ntoskrnl/ke/queue.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ke/queue.c?rev=23…
==============================================================================
--- trunk/reactos/ntoskrnl/ke/queue.c (original)
+++ trunk/reactos/ntoskrnl/ke/queue.c Fri Jul 14 06:26:44 2006
@@ -390,6 +390,10 @@
                         &WaitBlock->WaitListEntry;
                     Timer->Header.WaitListHead.Blink =
                         &WaitBlock->WaitListEntry;
+                    WaitBlock->WaitListEntry.Flink =
+                        &Timer->Header.WaitListHead;
+                    WaitBlock->WaitListEntry.Blink =
+                        &Timer->Header.WaitListHead;
 
                     /* Create Timer */
                     KiInsertTimer(Timer, *Timeout);
@@ -427,8 +431,8 @@
                 /* Check if we had a timeout */
                 if (Timeout)
                 {
-                    /* FIXME: Fixup interval */
-                    DPRINT1("FIXME!!!\n");
+                    DPRINT1("If you see this message, contact Alex ASAP\n");
+                    KEBUGCHECK(0);
                 }
             }
 

Modified: trunk/reactos/ntoskrnl/ke/wait.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/ke/wait.c?rev=230…
==============================================================================
--- trunk/reactos/ntoskrnl/ke/wait.c (original)
+++ trunk/reactos/ntoskrnl/ke/wait.c Fri Jul 14 06:26:44 2006
@@ -360,7 +360,9 @@
                 return WaitStatus;
             }
 
-            /* FIXME: Fixup interval */
+            /* Check if we had a timeout */
+            DPRINT1("If you see this message, contact Alex ASAP\n");
+            KEBUGCHECK(0);
         }
 
         /* Acquire again the lock */
@@ -533,7 +535,8 @@
             /* Check if we had a timeout */
             if (Timeout)
             {
-                 /* FIXME: Fixup interval */
+                DPRINT1("If you see this message, contact Alex ASAP\n");
+                KEBUGCHECK(0);
             }
         }
 
@@ -813,7 +816,8 @@
             /* Check if we had a timeout */
             if (Timeout)
             {
-                /* FIXME: Fixup interval */
+                DPRINT1("If you see this message, contact Alex ASAP\n");
+                KEBUGCHECK(0);
             }
 
             /* Acquire again the lock */