a bug in put_irq_handler and rm_irq_handle(Minix3)

讨论网址：

In my opinion, it may occur that in the same irq_handlers entry(for
example irq_handlers[5]), two or more hooks have the same id:

/
*=============================

==============================================*
 *                              put_irq_handler                              *

*===========================================================================*/
PUBLIC void put_irq_handler(hook, irq, handler)
irq_hook_t *hook;
int irq;
irq_handler_t handler;
{
/* Register an interrupt handler. */
 int id;
 irq_hook_t **line;

 if (irq < 0 || irq >= NR_IRQ_VECTORS)
     panic("invalid call to put_irq_handler", irq);

 line = &irq_handlers[irq];
 id = 1;
 while (*line != NULL) {
     if (hook == *line) return;        /* extra initialization */
     line = &(*line)->next;
     id <<= 1;
 }
 if (id == 0) panic("Too many handlers for irq", irq);

 hook->next = NULL;
 hook->handler = handler;
 hook->irq = irq;
 hook->id = id;
 *line = hook;

 irq_use |= 1 << irq;
}

/
*===========================================================================*
 *                              rm_irq_handler                               *

*===========================================================================*/
PUBLIC void rm_irq_handler(hook)
irq_hook_t *hook;
{
/* Unregister an interrupt handler. */
 int irq = hook->irq;
 int id = hook->id;
 irq_hook_t **line;

 if (irq < 0 || irq >= NR_IRQ_VECTORS)
     panic("invalid call to rm_irq_handler", irq);

 line = &irq_handlers[irq];
 while (*line != NULL) {
     if ((*line)->id == id) {
         (*line) = (*line)->next;
         if (! irq_handlers[irq]) irq_use &= ~(1 << irq);
         return;
     }
     line = &(*line)->next;
 }
 /* When the handler is not found, normally return here. */
}

put_irq_handler(hook, 5, handler);
put_irq_handler(hook, 5, handler);
put_irq_handler(hook, 5, handler);
put_irq_handler(hook, 5, handler);
put_irq_handler(hook, 5, handler);
rm_irq_handler(hook);                                          //(hook->irq == 5, hook->id == 0x2)
put_irq_handler(hook, 5, handler);

if we
call the put_irq_handler five times continues, there will be five
hooks in the irq_handlers[5], and ids will be 0x1 0x2 0x4 0x8 0x10
respectively,
then call rm_irq_handler(hook), four hooks in the irq_handlers[5], ids
0x1 0x4 0x8 0x10,
then call put_irq_handler(hook, 5, handler); ids: 0x1 0x40 0x80 0x10
0x10

in the case, if we call rm_irq_handler(hook)((hook->irq == 5, hook->id
== 0x10)), which hook we should delete.