Page MenuHomeFreeBSD

umtx: Do not make an exiting thread the owner of a PI mutex
ClosedPublic

Authored by markj on Jul 24 2026, 10:35 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Sep 14, 4:47 AM
Unknown Object (File)
Wed, Sep 9, 11:50 AM
Unknown Object (File)
Tue, Sep 8, 9:48 AM
Unknown Object (File)
Tue, Sep 8, 4:44 AM
Unknown Object (File)
Sun, Sep 6, 3:39 AM
Unknown Object (File)
Fri, Sep 4, 5:21 PM
Unknown Object (File)
Fri, Sep 4, 8:15 AM
Unknown Object (File)
Thu, Sep 3, 11:24 PM
Subscribers

Details

Summary

Otherwise an assertion in umtx_thread_alloc()
(TAILQ_EMPTY(&uq->uq_pi_contested)) is violated.

This use of TDB_EXIT is hacky and I don't really like it, but I cannot
see another way to check for an exiting thread without adding some more
overhead to kern_thr_exit().

Fixes: 2a339d9e3dc1
Reported by: Maik Muench of Secfault Security

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable