[Bug nptl/10262] New: 32-bit lowlevellock.S passing invalid combination of flags to __NR_futex syscall

["bz-glibc at kdzbn dot homelinux dot net" <sourceware-bugzilla at sourceware dot org>]

If __ASSUME_PRIVATE_FUTEX is defined, then LOAD_FUTEX_WAIT_ABS(reg) (in
nptl/sysdeps/unix/sysv/linux/i386/486/lowlevellock.S) is defined as:

xorl	$(FUTEX_WAIT_BITSET | FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME), reg

However, if __ASSUME_PRIVATE_FUTEX is not defined (as in, e.g., a build with
--enable-kernel=2.6.18 or older), then LOAD_FUTEX_WAIT_ABS(reg) is defined as:

xorl	$FUTEX_PRIVATE_FLAG, reg ; \
andl	%gs:PRIVATE_FUTEX, reg ; \
orl	$FUTEX_WAIT | FUTEX_CLOCK_REALTIME, reg

So __lll_timedlock_wait passes FUTEX_WAIT|FUTEX_CLOCK_REALTIME to the futex
syscall.  In Linux kernel 2.6.29.2 (and presumably later, though I haven't
looked), kernel/futex.c (do_futex) has this to say, where "op" is what the glibc
code puts into "reg" above:

	int cmd = op & FUTEX_CMD_MASK;

	/*...*/

	clockrt = op & FUTEX_CLOCK_REALTIME;
	if (clockrt && cmd != FUTEX_WAIT_BITSET)
		return -ENOSYS;

So if FUTEX_CLOCK_REALTIME is ever set, but the FUTEX_CMD_MASK bits are not set
to FUTEX_WAIT_BITSET, the syscall fails.  (FUTEX_CMD_MASK is
(~(FUTEX_PRIVATE_FLAG|FUTEX_CLOCK_REALTIME)), according to futex.h in the
kernel.  So cmd is "everything except the realtime and private bits".)

It looks like the x86_64 version of this file (that is,
nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S) uses the correct constant
for both states of __ASSUME_PRIVATE_FUTEX.  I am unsure on the actual impact of
this (-ENOSYS might not be a real problem here), and I'm not sure how well this
is tested, but here's a patch to fix the issue (just change FUTEX_WAIT to
FUTEX_WAIT_BITSET):

diff -Naur glibc-2.10.1/nptl/sysdeps/unix/sysv/linux/i386/i486/lowlevellock.S
glibc-2.10.1-patched/nptl/sysdeps/unix/sysv/linux/i386/i486/lowlevellock.S
--- glibc-2.10.1/nptl/sysdeps/unix/sysv/linux/i386/i486/lowlevellock.S
2009-01-03 15:17:21.000000000 -0800
+++ glibc-2.10.1-patched/nptl/sysdeps/unix/sysv/linux/i386/i486/lowlevellock.S
2009-06-10 22:06:51.000000000 -0700
@@ -60,7 +60,7 @@
 # define LOAD_FUTEX_WAIT_ABS(reg) \
 	xorl	$FUTEX_PRIVATE_FLAG, reg ; \
 	andl	%gs:PRIVATE_FUTEX, reg ; \
-	orl	$FUTEX_WAIT | FUTEX_CLOCK_REALTIME, reg
+	orl	$FUTEX_WAIT_BITSET | FUTEX_CLOCK_REALTIME, reg
 # define LOAD_FUTEX_WAKE(reg) \
 	xorl	$FUTEX_PRIVATE_FLAG, reg ; \
 	andl	%gs:PRIVATE_FUTEX, reg ; \

-- 
           Summary: 32-bit lowlevellock.S passing invalid combination of
                    flags to __NR_futex syscall
           Product: glibc
           Version: 2.10
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nptl
        AssignedTo: drepper at redhat dot com
        ReportedBy: bz-glibc at kdzbn dot homelinux dot net
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu


http://sourceware.org/bugzilla/show_bug.cgi?id=10262

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.