Page MenuHomeFreeBSD

sigtimedwait: Use a unique wait channel for sleeping
ClosedPublic

Authored by markj on Aug 16 2021, 5:19 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Sep 11, 7:51 AM
Unknown Object (File)
Fri, Sep 11, 6:59 AM
Unknown Object (File)
Fri, Sep 11, 3:56 AM
Unknown Object (File)
Wed, Sep 9, 6:22 AM
Unknown Object (File)
Sun, Sep 6, 11:07 PM
Unknown Object (File)
Sun, Sep 6, 2:23 PM
Unknown Object (File)
Sat, Sep 5, 4:28 AM
Unknown Object (File)
Thu, Sep 3, 10:54 AM
Subscribers

Details

Summary

When a sigtimedwait(2) caller goes to sleep, it uses a wait channel of
p->p_sigacts with the proc lock as the interlock. However, p_sigacts
can be shared between processes if a child is created with
rfork(RFSIGSHARE | RFPROC). Thus we can end up with two threads
sleeping on the same wait channel using different locks, which is not
permitted.

Fix the problem simply by using a process-unique wait channel, following
the example of sigsuspend. I believe the actual wait channel value is
irrelevant here, sleeping threads are awoken using sleepq_abort().

Reported by: syzbot+8c417afabadb50bb8827@syzkaller.appspotmail.com
Reported by: syzbot+1d89fc2a9ef92ef64fa8@syzkaller.appspotmail.com

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable