[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20240727155652.GP10433@brightrain.aerifal.cx>
Date: Sat, 27 Jul 2024 11:56:52 -0400
From: Rich Felker <dalias@...c.org>
To: JinCheng Li <naiveli233@...look.com>
Cc: "musl@...ts.openwall.com" <musl@...ts.openwall.com>,
Markus Wichmann <nullplan@....net>
Subject: Re: Possible unfair scenarios in pthread_mutex_unlock
On Sat, Jul 27, 2024 at 01:38:55PM +0000, JinCheng Li wrote:
> Hi
>
> > > I have two questions in pthread_mutex_unlock.
> > >
> > > 1.
> > > Why we need a vmlock in only pshared mutex, not in other private mutex?
>
> > Because only in the pshared case it is valid to have the mutex in a
> > shared memory, and unmap the shared memory immediately following an
> > unlock.
>
> Sorry, I still don't fully understand.
>
> 1.
> The vmlock is a private lock of a process. How does it work in pshared mutex(shared cross-process memory)? What's its real role?
> 2.
> Why munmap have to do vm_wait? It looks like we need to do vm_wait even if I'm not munmapping shared memory. If I'm releasing a pshared lock, are all munmaps blocked until the mutex been unlocked?
> 3.
> Can you provide an example of this vm_lock in action(where this lock must exist and work)?
Mutex M, threads A and B. Initially A holds lock.
A: Stores pointer to M on robust list pending slot
A: Writes a 0 to lock word of M
B: Succeeds acquiring M
B: Does something with state protected by M
B: Unlocks and unmaps M
B: Maps a file with MAP_SHARED, happens to get same address M had.
At this point, suppose the process gets terminated by a signal. Now
the kernel walks the robust list and pending slot fields to find
mutexes it needs to put into OWNERDEAD state. It finds the address of
M in A's pending slot. Now the kernel inspects and possibly writes to
the memory at this address, but it's not writing to the mutex. Instead
it's overwriting contents of an unrelated file.
This is a fundamental design flaw in Linux's robust list handling, and
the only fix we could find is precluding munmap or mmap with MAP_FIXED
until the robust list pending slot is cleared.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
