Re: [musl] __pthread_mutex_unlock uninitialized value

[Leonid Shamis <leonid.shamis@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1485 bytes --]

Apologies. First post. I'll use the official repo from now on.

This was originally brought to my attention via static analysis:

warning: ‘old’ may be used uninitialized in this function
[-Wmaybe-uninitialized]
   __asm__ __volatile__("lock ; cmpxchg %3, %1" : "=a"(t), "=m"(*p) :
"a"(t), "r"(s) : "memory");
   ^~~~~~~

And in my reading, I thought the (type != PTHREAD_MUTEX_NORMAL) only
checked the bottom three bits.

Please disregard this email chain :)

On Fri, Mar 27, 2020 at 11:16 AM Rich Felker <dalias@libc.org> wrote:

> On Fri, Mar 27, 2020 at 10:52:58AM -0700, Leonid Shamis wrote:
> >
> https://github.com/bminor/musl/blob/54ca677983d47529bab8752315ac1a2b49888870/src/thread/pthread_mutex_unlock.c#L34
>
> BTW official git is here:
>
>
> https://git.musl-libc.org/cgit/musl/tree/src/thread/pthread_mutex_unlock.c?id=v1.2.0
>
> > In the case where a mutex:
> > is one of PTHREAD_MUTEX_ERRORCHECK or PTHREAD_MUTEX_RECURSIVE
> > and PTHREAD_PRIO_INHERIT
> >
> > an uninitialized value of 'old' is used to check whether to futex.
>
> Can you elaborate on this? In line 15, old is assigned; this applies
> to all mutex types except plain boring normal (without PI and without
> robust). The condition in line 33 can only be true if type is nonzero
> (not plain boring normal mutex) so I don't see any way it can be used
> uninitialized in line 34. Is your report based on your own reading or
> a static analysis tool?
>
> Rich
>

[-- Attachment #2: Type: text/html, Size: 2282 bytes --]