linux-kernel - Re: Robust futexes: lost wakeups and design flaws in the glibc/kernel synchronization scheme

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1484346315.5606.313.camel@redhat.com>
Date:   Fri, 13 Jan 2017 23:25:15 +0100
From:   Torvald Riegel <triegel@...hat.com>
To:     LKML <linux-kernel@...r.kernel.org>
Cc:     GLIBC Devel <libc-alpha@...rceware.org>,
        "Zijlstra, Peter" <peter.zijlstra@...el.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Rich Felker <dalias@...c.org>
Subject: Re: Robust futexes: lost wakeups and design flaws in the
 glibc/kernel synchronization scheme

On Thu, 2017-01-12 at 10:39 +0100, Torvald Riegel wrote:
> On Sat, 2016-12-24 at 17:01 +0100, Torvald Riegel wrote:
> > === Robust mutexes have bugs, in both glibc and the kernel
> > 
> > I've been reviewing the implementation of robust mutexes in both glibc
> > and the kernel support code recently because there are several bug
> > reports, for example:
> > https://bugzilla.redhat.com/show_bug.cgi?id=1401665
> > https://sourceware.org/bugzilla/show_bug.cgi?id=19402
> > https://sourceware.org/bugzilla/show_bug.cgi?id=14485
> > 
> > This review revealed a bunch of bugs.  I have committed/proposed patches
> > that fix all glibc-only bugs that I am aware of:
> > https://sourceware.org/ml/libc-alpha/2016-12/msg00587.html
> > https://sourceware.org/ml/libc-alpha/2016-12/msg00862.html
> > https://sourceware.org/ml/libc-alpha/2016-12/msg00863.html
> > https://sourceware.org/ml/libc-alpha/2016-12/msg00947.html

These patches are now all committed to glibc master.  Thus, you can
start fixing/testing now and have a high probability that you won't run
into glibc bugs.