NIM: BUG: LIB: deadlock in kmq

Do not obtain a critical section that is already being held:
	"cs_kmq_types"

Update the docs to indicate the additional restriction.

ticket: new
component: windows

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@20025 dc483132-0cff-0310-8789-dd5450dbe970

3 files changed, 19 insertions, 0 deletions

diff --git a/src/windows/identity/kmq/consumer.c b/src/windows/identity/kmq/consumer.c
index 2837d304c..dd21834c6 100644
--- a/src/windows/identity/kmq/consumer.c
+++ b/src/windows/identity/kmq/consumer.c
@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2005 Massachusetts Institute of Technology
+ * 
+ * Copyright (c) 2007 Secure Endpoints Inc.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -201,6 +203,7 @@ void kmqint_post_queue(kmq_queue * q, kmq_message *m) {
     \brief Post a message to a subscriber
     \note Obtains ::cs_kmq_msg_ref, ::cs_kmq_msg, kmq_queue::cs
     \note Should be called with ::cs_kmq_msg held
+    \note Should be called with ::cs_kmq_types held if try_send is true
     */
 void kmqint_post(kmq_msg_subscription * s, kmq_message * m, khm_boolean try_send) {
     if(s->rcpt_type == KMQ_RCPTTYPE_CB) {
diff --git a/src/windows/identity/kmq/kmq.h b/src/windows/identity/kmq/kmq.h
index 7ea9450ca..db6d5b262 100644
--- a/src/windows/identity/kmq/kmq.h
+++ b/src/windows/identity/kmq/kmq.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (c) 2005 Massachusetts Institute of Technology
  *
+ * Copyright (c) 2007 Secure Endpoints Inc.
+ *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
  * files (the "Software"), to deal in the Software without
@@ -604,6 +606,9 @@ KHMEXP khm_int32 KHMAPI kmq_free_call(kmq_call call);
     becomes active will exit with a KHM_ERROR_EXIT code.
     kmq_send_thread_quit_message() will wait for this to happen before
     returning.
+
+    This function should not be called by the thread identified by the
+    \a thread parameter.
     */
 KHMEXP khm_int32 KHMAPI kmq_send_thread_quit_message(
     kmq_thread_id thread, 
diff --git a/src/windows/identity/kmq/publisher.c b/src/windows/identity/kmq/publisher.c
index 2323837e2..754288811 100644
--- a/src/windows/identity/kmq/publisher.c
+++ b/src/windows/identity/kmq/publisher.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (c) 2005 Massachusetts Institute of Technology
  *
+ * Copyright (c) 2007 Secure Endpoints Inc.
+ *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
  * files (the "Software"), to deal in the Software without
@@ -296,6 +298,8 @@ kmqint_post_sub_msg_ex(khm_handle sub, khm_int32 type, khm_int32 subtype,
     } else
         m->wait_o = NULL;
 
+    if (try_send)
+        EnterCriticalSection(&cs_kmq_types);
     EnterCriticalSection(&cs_kmq_msg);
     kmqint_post((kmq_msg_subscription *) sub, m, try_send);
 
@@ -303,6 +307,8 @@ kmqint_post_sub_msg_ex(khm_handle sub, khm_int32 type, khm_int32 subtype,
         kmqint_put_message(m);
     }
     LeaveCriticalSection(&cs_kmq_msg);
+    if (try_send)
+        LeaveCriticalSection(&cs_kmq_types);
 
     return KHM_ERROR_SUCCESS;
 }
@@ -356,6 +362,8 @@ kmqint_post_subs_msg_ex(khm_handle * subs, khm_size   n_subs, khm_int32 type,
     } else
         m->wait_o = NULL;
 
+    if (try_send)
+        EnterCriticalSection(&cs_kmq_types);
     EnterCriticalSection(&cs_kmq_msg);
     for(i=0;i<n_subs;i++) {
         kmqint_post((kmq_msg_subscription *) subs[i], m, try_send);
@@ -365,6 +373,8 @@ kmqint_post_subs_msg_ex(khm_handle * subs, khm_size   n_subs, khm_int32 type,
         kmqint_put_message(m);
     }
     LeaveCriticalSection(&cs_kmq_msg);
+    if (try_send)
+        EnterCriticalSection(&cs_kmq_types);
 
     return KHM_ERROR_SUCCESS;
 }
@@ -554,3 +564,4 @@ kmq_set_completion_handler(khm_int32 type,
 }
 
 
+