From: Bobby Bingham <koorogi@koorogi.info>
To: musl@lists.openwall.com
Subject: Re: [musl] race condition in sem_wait
Date: Tue, 18 Feb 2020 22:07:54 -0600 [thread overview]
Message-ID: <87mu9f9q3p.fsf@koorogi.info> (raw)
In-Reply-To: <8a85b4ac-e1ed-dc30-bdad-b1e33ed20257@newmedia-net.de> (Sebastian Gottschall's message of "Wed, 19 Feb 2020 01:46:34 +0100")
Sebastian Gottschall <s.gottschall@newmedia-net.de> writes:
> Hello
>
> i discovered recently a race condition while playing with threads and
> sem_wait/sem_post
> sem_wait may fail with errno set EAGAIN which is not valid since only
> sem_trywait is able to set that errno code.
> this was causing a bug with a later select() and accept() which failed
> since accept does not work if errno is set to EAGAIN.
Whether select/accept work or not should not be impacted by any existing
value in errno.
> from my point of view the bug is in sem_timedwait.c
>
> if (!sem_trywait(sem)) return 0;
>
> int spins = 100;
> while (spins-- && sem->__val[0] <= 0 && !sem->__val[1]) a_spin();
>
> while (sem_trywait(sem)) {
>
>
> the fist sem_trywait will fail with -1 and sets EAGAIN. but the second
> sem_trywait will not fail and does return 0. the problem now is that
> errno is still present and not reset.
> this may cause if sem_post is called from a second thread on the same
> semaphore.
> of course the same bug affects sem_timedwait itself.
> so i assume sem_wait is not thread safe which is bad and is not follow
> the posix specification
To quote POSIX [1]:
The value of errno should only be examined when it is indicated to
be valid by a function's return value. [...] The setting of errno
after a successful call to a function is unspecified unless the
description of that function specifies that errno shall not be
modified.
If sem_wait() returns zero, then the value in errno after the call
returns is not meaningful in any way.
[1] https://pubs.opengroup.org/onlinepubs/9699919799/functions/errno.html
>
> or am i wrong here?
>
>
> Sebastian
Bobby
next prev parent reply other threads:[~2020-02-19 4:08 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-18 19:38 [musl] Locale support considered harmful noise Jacob Welsh
2020-02-18 21:42 ` A. Wilcox
2020-02-18 22:23 ` Hadrien Lacour
2020-02-18 23:29 ` [musl] race condition in sem_wait Sebastian Gottschall
2020-02-19 0:46 ` Sebastian Gottschall
2020-02-19 3:39 ` Rich Felker
2020-02-19 8:26 ` Sebastian Gottschall
2020-02-19 14:13 ` Rich Felker
2020-02-19 4:07 ` Bobby Bingham [this message]
2020-02-19 21:28 ` [musl] Locale support considered harmful noise Jacob Welsh
2020-02-19 22:06 ` Rich Felker
2020-02-19 3:36 ` Rich Felker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87mu9f9q3p.fsf@koorogi.info \
--to=koorogi@koorogi.info \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).