Date: Tue, 23 May 2017 07:26:45 +0000 (UTC) From: Ngie Cooper <ngie@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r318715 - head/lib/libc/sys Message-ID: <201705230726.v4N7QjRf078716@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: ngie Date: Tue May 23 07:26:45 2017 New Revision: 318715 URL: https://svnweb.freebsd.org/changeset/base/318715 Log: _umtx_op(2): fix minor manlint issues - Sort .Xr entries in SEE ALSO section. - Sort SEE ALSO and STANDARDS sections properly, in terms of the entire document. Reported by: make manlint MFC after: 2 weeks Sponsored by: Dell EMC Isilon Modified: head/lib/libc/sys/_umtx_op.2 Modified: head/lib/libc/sys/_umtx_op.2 ============================================================================== --- head/lib/libc/sys/_umtx_op.2 Tue May 23 07:21:26 2017 (r318714) +++ head/lib/libc/sys/_umtx_op.2 Tue May 23 07:26:45 2017 (r318715) @@ -28,7 +28,7 @@ .\" .\" $FreeBSD$ .\" -.Dd May 29, 2016 +.Dd May 23, 2017 .Dt _UMTX_OP 2 .Os .Sh NAME @@ -1382,32 +1382,11 @@ Mutex lock requests without timeout spec The error is not returned to userspace code since restart is handled by usual adjustment of the instruction counter. .El -.Sh BUGS -A window between a unlocking robust mutex and resetting the pointer in the -.Dv robust_inact_offset -member of the registered -.Vt struct umtx_robust_lists_params -allows another thread to destroy the mutex, thus making the kernel inspect -freed or reused memory. -The -.Li libthr -implementation is only vulnerable to this race when operating on -a shared mutex. -A possible fix for the current implementation is to strengthen the checks -for shared mutexes before terminating them, in particular, verifying -that the mutex memory is mapped from a shared memory object allocated -by the -.Dv UMTX_OP_SHM -request. -This is not done because it is believed that the race is adequately -covered by other consistency checks, while adding the check would -prevent alternative implementations of -.Li libpthread . .Sh SEE ALSO .Xr clock_gettime 2 , .Xr mmap 2 , -.Xr shm_open 2 , .Xr setrlimit 2 , +.Xr shm_open 2 , .Xr sigaction 2 , .Xr thr_exit 2 , .Xr thr_kill 2 , @@ -1425,3 +1404,24 @@ to implement .St -p1003.1-2001 .Xr pthread 3 functionality. +.Sh BUGS +A window between a unlocking robust mutex and resetting the pointer in the +.Dv robust_inact_offset +member of the registered +.Vt struct umtx_robust_lists_params +allows another thread to destroy the mutex, thus making the kernel inspect +freed or reused memory. +The +.Li libthr +implementation is only vulnerable to this race when operating on +a shared mutex. +A possible fix for the current implementation is to strengthen the checks +for shared mutexes before terminating them, in particular, verifying +that the mutex memory is mapped from a shared memory object allocated +by the +.Dv UMTX_OP_SHM +request. +This is not done because it is believed that the race is adequately +covered by other consistency checks, while adding the check would +prevent alternative implementations of +.Li libpthread .
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201705230726.v4N7QjRf078716>