This is the mail archive of the
glibc-bugs@sourceware.org
mailing list for the glibc project.
[Bug nptl/10262] New: 32-bit lowlevellock.S passing invalid combination of flags to __NR_futex syscall
- From: "bz-glibc at kdzbn dot homelinux dot net" <sourceware-bugzilla at sourceware dot org>
- To: glibc-bugs at sources dot redhat dot com
- Date: 11 Jun 2009 05:14:20 -0000
- Subject: [Bug nptl/10262] New: 32-bit lowlevellock.S passing invalid combination of flags to __NR_futex syscall
- Reply-to: sourceware-bugzilla at sourceware dot org
If __ASSUME_PRIVATE_FUTEX is defined, then LOAD_FUTEX_WAIT_ABS(reg) (in
nptl/sysdeps/unix/sysv/linux/i386/486/lowlevellock.S) is defined as:
xorl $(FUTEX_WAIT_BITSET | FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME), reg
However, if __ASSUME_PRIVATE_FUTEX is not defined (as in, e.g., a build with
--enable-kernel=2.6.18 or older), then LOAD_FUTEX_WAIT_ABS(reg) is defined as:
xorl $FUTEX_PRIVATE_FLAG, reg ; \
andl %gs:PRIVATE_FUTEX, reg ; \
orl $FUTEX_WAIT | FUTEX_CLOCK_REALTIME, reg
So __lll_timedlock_wait passes FUTEX_WAIT|FUTEX_CLOCK_REALTIME to the futex
syscall. In Linux kernel 2.6.29.2 (and presumably later, though I haven't
looked), kernel/futex.c (do_futex) has this to say, where "op" is what the glibc
code puts into "reg" above:
int cmd = op & FUTEX_CMD_MASK;
/*...*/
clockrt = op & FUTEX_CLOCK_REALTIME;
if (clockrt && cmd != FUTEX_WAIT_BITSET)
return -ENOSYS;
So if FUTEX_CLOCK_REALTIME is ever set, but the FUTEX_CMD_MASK bits are not set
to FUTEX_WAIT_BITSET, the syscall fails. (FUTEX_CMD_MASK is
(~(FUTEX_PRIVATE_FLAG|FUTEX_CLOCK_REALTIME)), according to futex.h in the
kernel. So cmd is "everything except the realtime and private bits".)
It looks like the x86_64 version of this file (that is,
nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S) uses the correct constant
for both states of __ASSUME_PRIVATE_FUTEX. I am unsure on the actual impact of
this (-ENOSYS might not be a real problem here), and I'm not sure how well this
is tested, but here's a patch to fix the issue (just change FUTEX_WAIT to
FUTEX_WAIT_BITSET):
diff -Naur glibc-2.10.1/nptl/sysdeps/unix/sysv/linux/i386/i486/lowlevellock.S
glibc-2.10.1-patched/nptl/sysdeps/unix/sysv/linux/i386/i486/lowlevellock.S
--- glibc-2.10.1/nptl/sysdeps/unix/sysv/linux/i386/i486/lowlevellock.S
2009-01-03 15:17:21.000000000 -0800
+++ glibc-2.10.1-patched/nptl/sysdeps/unix/sysv/linux/i386/i486/lowlevellock.S
2009-06-10 22:06:51.000000000 -0700
@@ -60,7 +60,7 @@
# define LOAD_FUTEX_WAIT_ABS(reg) \
xorl $FUTEX_PRIVATE_FLAG, reg ; \
andl %gs:PRIVATE_FUTEX, reg ; \
- orl $FUTEX_WAIT | FUTEX_CLOCK_REALTIME, reg
+ orl $FUTEX_WAIT_BITSET | FUTEX_CLOCK_REALTIME, reg
# define LOAD_FUTEX_WAKE(reg) \
xorl $FUTEX_PRIVATE_FLAG, reg ; \
andl %gs:PRIVATE_FUTEX, reg ; \
--
Summary: 32-bit lowlevellock.S passing invalid combination of
flags to __NR_futex syscall
Product: glibc
Version: 2.10
Status: NEW
Severity: normal
Priority: P2
Component: nptl
AssignedTo: drepper at redhat dot com
ReportedBy: bz-glibc at kdzbn dot homelinux dot net
CC: glibc-bugs at sources dot redhat dot com
GCC build triplet: i686-pc-linux-gnu
GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu
http://sourceware.org/bugzilla/show_bug.cgi?id=10262
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.