From owner-svn-src-head@freebsd.org Tue May 23 07:26:46 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C6E1CD7A711; Tue, 23 May 2017 07:26:46 +0000 (UTC) (envelope-from ngie@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 885451B13; Tue, 23 May 2017 07:26:46 +0000 (UTC) (envelope-from ngie@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v4N7QjbI078717; Tue, 23 May 2017 07:26:45 GMT (envelope-from ngie@FreeBSD.org) Received: (from ngie@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v4N7QjRf078716; Tue, 23 May 2017 07:26:45 GMT (envelope-from ngie@FreeBSD.org) Message-Id: <201705230726.v4N7QjRf078716@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: ngie set sender to ngie@FreeBSD.org using -f From: Ngie Cooper Date: Tue, 23 May 2017 07:26:45 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r318715 - head/lib/libc/sys X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 May 2017 07:26:46 -0000 Author: ngie Date: Tue May 23 07:26:45 2017 New Revision: 318715 URL: https://svnweb.freebsd.org/changeset/base/318715 Log: _umtx_op(2): fix minor manlint issues - Sort .Xr entries in SEE ALSO section. - Sort SEE ALSO and STANDARDS sections properly, in terms of the entire document. Reported by: make manlint MFC after: 2 weeks Sponsored by: Dell EMC Isilon Modified: head/lib/libc/sys/_umtx_op.2 Modified: head/lib/libc/sys/_umtx_op.2 ============================================================================== --- head/lib/libc/sys/_umtx_op.2 Tue May 23 07:21:26 2017 (r318714) +++ head/lib/libc/sys/_umtx_op.2 Tue May 23 07:26:45 2017 (r318715) @@ -28,7 +28,7 @@ .\" .\" $FreeBSD$ .\" -.Dd May 29, 2016 +.Dd May 23, 2017 .Dt _UMTX_OP 2 .Os .Sh NAME @@ -1382,32 +1382,11 @@ Mutex lock requests without timeout spec The error is not returned to userspace code since restart is handled by usual adjustment of the instruction counter. .El -.Sh BUGS -A window between a unlocking robust mutex and resetting the pointer in the -.Dv robust_inact_offset -member of the registered -.Vt struct umtx_robust_lists_params -allows another thread to destroy the mutex, thus making the kernel inspect -freed or reused memory. -The -.Li libthr -implementation is only vulnerable to this race when operating on -a shared mutex. -A possible fix for the current implementation is to strengthen the checks -for shared mutexes before terminating them, in particular, verifying -that the mutex memory is mapped from a shared memory object allocated -by the -.Dv UMTX_OP_SHM -request. -This is not done because it is believed that the race is adequately -covered by other consistency checks, while adding the check would -prevent alternative implementations of -.Li libpthread . .Sh SEE ALSO .Xr clock_gettime 2 , .Xr mmap 2 , -.Xr shm_open 2 , .Xr setrlimit 2 , +.Xr shm_open 2 , .Xr sigaction 2 , .Xr thr_exit 2 , .Xr thr_kill 2 , @@ -1425,3 +1404,24 @@ to implement .St -p1003.1-2001 .Xr pthread 3 functionality. +.Sh BUGS +A window between a unlocking robust mutex and resetting the pointer in the +.Dv robust_inact_offset +member of the registered +.Vt struct umtx_robust_lists_params +allows another thread to destroy the mutex, thus making the kernel inspect +freed or reused memory. +The +.Li libthr +implementation is only vulnerable to this race when operating on +a shared mutex. +A possible fix for the current implementation is to strengthen the checks +for shared mutexes before terminating them, in particular, verifying +that the mutex memory is mapped from a shared memory object allocated +by the +.Dv UMTX_OP_SHM +request. +This is not done because it is believed that the race is adequately +covered by other consistency checks, while adding the check would +prevent alternative implementations of +.Li libpthread .