From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FROM,HTML_MESSAGE,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,RDNS_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: (qmail 4473 invoked from network); 27 Mar 2020 18:23:53 -0000 Received-SPF: pass (mother.openwall.net: domain of lists.openwall.com designates 195.42.179.200 as permitted sender) receiver=inbox.vuxu.org; client-ip=195.42.179.200 envelope-from= Received: from unknown (HELO mother.openwall.net) (195.42.179.200) by inbox.vuxu.org with ESMTP; 27 Mar 2020 18:23:53 -0000 Received: (qmail 32159 invoked by uid 550); 27 Mar 2020 18:23:52 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 32141 invoked from network); 27 Mar 2020 18:23:51 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=LUq63c8bF6HZK/gi7GSXwzno5W45yL9WHOS4yEYEjJU=; b=jbpk7y12RXNKPTTxDQp/mQmINY9Nk1sIZnJ7yQnrK9Z4GfOSdAMAEHSKUMyG3WTb8N mYvFK4ASofwB79gj3sFnLdNWxgJdPqPBztxfngUdKKh1Vz1c5bxgd7kTcopXt7FhDMGX KkNeFdYMmLASSGIdPw+euyJO4ke50rplek9RYRiRYaJ4SnWcagQ+2cpWGCxSxlhv1GNM f9KtDIGMcwPipwNffSHXkw2Usu0mkOVbAmSRaN3soR5dbFctrmWwpaWIpqbGR4n6bRMK rEPfaqWlc7eqlbdSq196KVncDXiBiAostJKK0ppJOhbDP4Eu4eaeKaIbeTCbRxxj6cRz AiNg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=LUq63c8bF6HZK/gi7GSXwzno5W45yL9WHOS4yEYEjJU=; b=K5VsD4Yi1+iyokJewbRa9xQyFRXs50nnAgL2zKGPAB7M7gwjidRpyCDK4adN5zG7Vu gOhM3qYSjWNJNZIDJze5pCVirfk+9EX8/w+wEZIYJMN4NE5fNsRywWYdpboiORzHTquE o+bXacWXFu2D6G7Kq2B23gASGb6CsIl6CRyA02E6ZO6Qb9EAKKyLLf/idKTbfJ5aUa24 WY+Sl58fjWPzH+2gCHQBfLzEUQX5yAY4QHgJ3KhK6/340VzT6t9spe6NYBYCCUZBszIG DZ5DLVmcIpVaAtX9ndZys9D+U1Uaw9DYsgiNDZqTsIOfACZRgWztrfy0ZAeChqFkkwWt GbUg== X-Gm-Message-State: AGi0PubiiMjEBJnycWMBa44D0CQD8+xPb8OJ/ECbEvV6L3NKH9xfm9oD denqVHS6JAIPLzfsEWHnewR91RLd+RJ4zndo7nz2s1eWEVU= X-Google-Smtp-Source: APiQypKxNHsa9F8ueNKuacsqh9CQYrGp/fPZwECoYxdxWsb+3Hp2tP49dA6dDLhtNfeDtHXzb1s6NsqivVBgklbK/fc= X-Received: by 2002:a67:f3d3:: with SMTP id j19mr300604vsn.190.1585333419504; Fri, 27 Mar 2020 11:23:39 -0700 (PDT) MIME-Version: 1.0 References: <20200327181654.GH11469@brightrain.aerifal.cx> In-Reply-To: <20200327181654.GH11469@brightrain.aerifal.cx> From: Leonid Shamis Date: Fri, 27 Mar 2020 11:23:28 -0700 Message-ID: To: Rich Felker Cc: musl@lists.openwall.com Content-Type: multipart/alternative; boundary="00000000000051f86005a1da33b5" Subject: Re: [musl] __pthread_mutex_unlock uninitialized value --00000000000051f86005a1da33b5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Apologies. First post. I'll use the official repo from now on. This was originally brought to my attention via static analysis: warning: =E2=80=98old=E2=80=99 may be used uninitialized in this function [-Wmaybe-uninitialized] __asm__ __volatile__("lock ; cmpxchg %3, %1" : "=3Da"(t), "=3Dm"(*p) : "a"(t), "r"(s) : "memory"); ^~~~~~~ And in my reading, I thought the (type !=3D PTHREAD_MUTEX_NORMAL) only checked the bottom three bits. Please disregard this email chain :) On Fri, Mar 27, 2020 at 11:16 AM Rich Felker wrote: > On Fri, Mar 27, 2020 at 10:52:58AM -0700, Leonid Shamis wrote: > > > https://github.com/bminor/musl/blob/54ca677983d47529bab8752315ac1a2b49888= 870/src/thread/pthread_mutex_unlock.c#L34 > > BTW official git is here: > > > https://git.musl-libc.org/cgit/musl/tree/src/thread/pthread_mutex_unlock.= c?id=3Dv1.2.0 > > > In the case where a mutex: > > is one of PTHREAD_MUTEX_ERRORCHECK or PTHREAD_MUTEX_RECURSIVE > > and PTHREAD_PRIO_INHERIT > > > > an uninitialized value of 'old' is used to check whether to futex. > > Can you elaborate on this? In line 15, old is assigned; this applies > to all mutex types except plain boring normal (without PI and without > robust). The condition in line 33 can only be true if type is nonzero > (not plain boring normal mutex) so I don't see any way it can be used > uninitialized in line 34. Is your report based on your own reading or > a static analysis tool? > > Rich > --00000000000051f86005a1da33b5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Apologies. First post. I'll use the official repo= from=C2=A0now on.

This was originally brought to= =C2=A0my attention via static analysis:

warning: =E2=80= =98old=E2=80=99 may be used uninitialized in this function [-Wmaybe-uniniti= alized]
=C2=A0 =C2=A0__asm__ __volatile__("lock ; cmpxchg %3, %1&qu= ot; : "=3Da"(t), "=3Dm"(*p) : "a"(t), "r= "(s) : "memory");
=C2=A0 =C2=A0^~~~~~~

=
And in my reading, I thought the (type !=3D PTHREAD_MUTEX_NORMAL) only= checked the bottom three bits.

Please disregard t= his email chain :)

On Fri, Mar 27, 2020 at 11:16 AM Rich Felker <dalias@libc.org> wrote:
On Fri, Mar 27, 2020 at 10:= 52:58AM -0700, Leonid Shamis wrote:
> https://github.com/bminor/musl/blob/54ca677983d47529bab8= 752315ac1a2b49888870/src/thread/pthread_mutex_unlock.c#L34

BTW official git is here:

https://git.mu= sl-libc.org/cgit/musl/tree/src/thread/pthread_mutex_unlock.c?id=3Dv1.2.0

> In the case where a mutex:
> is one of PTHREAD_MUTEX_ERRORCHECK or PTHREAD_MUTEX_RECURSIVE
> and PTHREAD_PRIO_INHERIT
>
> an uninitialized value of 'old' is used to check whether to fu= tex.

Can you elaborate on this? In line 15, old is assigned; this applies
to all mutex types except plain boring normal (without PI and without
robust). The condition in line 33 can only be true if type is nonzero
(not plain boring normal mutex) so I don't see any way it can be used uninitialized in line 34. Is your report based on your own reading or
a static analysis tool?

Rich
--00000000000051f86005a1da33b5--