AgeCommit message (Collapse)AuthorLines
2011-08-11normal exit from timer thread should run dtors, restore cancel stateRich Felker-1/+1
2011-08-11block signals in timer threadsRich Felker-0/+4
if a timer thread leaves signals unblocked, any future attempt by the main thread to prevent the process from being terminated by blocking signals will fail, since the signal can still be delivered to the timer thread.
2011-08-07condition variable signal/bcast need not wake unless there are waitersRich Felker-4/+4
2011-08-07use weak aliase rather than weak reference for vdso clock_gettimeRich Felker-8/+12
this works around pcc's lack of working support for weak references, and in principle is nice because it gets us back to the stage where the only weak symbol feature we use is weak aliases, nothing else. having fewer dependencies on fancy linker features is a good thing.
2011-08-07simplify unified timed wait code, drop support for newer methodRich Felker-31/+28
the new absolute-time-based wait kernelside was hard to get right and basically just code duplication. it could only improve "performance" when waiting, and even then, the improvement was just slight drop in cpu usage during a wait. actually, with vdso clock_gettime, the "old" way will be even faster than the "new" way if the time has already expired, since it will not invoke any syscalls. it can determine entirely in userspace that it needs to return ETIMEDOUT.
2011-08-07add fast path for normal mutexes back to pthread_mutex_lockRich Felker-0/+3
2011-08-07close should not be cancellable after "failing" with EINTRRich Felker-1/+2
normally we allow cancellation to be acted upon when a syscall fails with EINTR, since there is no useful status to report to the caller in this case, and the signal that caused the interruption was almost surely the cancellation request, anyway. however, unlike all other syscalls, close has actually performed its resource-deallocation function whenever it returns, even when it returned an error. if we allow cancellation at this point, the caller has no way of informing the program that the file descriptor was closed, and the program may later try to close the file descriptor again, possibly closing a different, newly-opened file. the workaround looks ugly (special-casing one syscall), but it's actually the case that close is the one and only syscall (at least among cancellation points) with this ugly property.
2011-08-06ensure the compiler does not move around thread-register-based readsRich Felker-2/+2
if gcc decided to move this across a conditional that checks validity of the thread register, an invalid thread-register-based read could be performed and raise sigsegv.
2011-08-06simplify multi-threaded errno, eliminate useless function pointerRich Felker-12/+5
2011-08-06use weak aliases rather than function pointers to simplify some codeRich Felker-9/+20
2011-08-05fix off-by-one bug in siglongjmp that caused unpredictable behaviorRich Felker-1/+1
if saved, signal mask would not be restored unless some low signals were masked. if not saved, signal mask could be wrongly restored to uninitialized values. in any, wrong mask would be restored. i believe this function was written for a very old version of the jmp_buf structure which did not contain a final 0 field for compatibility with siglongjmp, and never updated...
2011-08-03further debloat cancellation handlersRich Felker-17/+30
cleanup push and pop are also no-ops if pthread_exit is not reachable. this can make a big difference for library code which needs to protect itself against cancellation, but which is unlikely to actually be used in programs with threads/cancellation.
2011-08-03missed detail in cancellation bloat fixRich Felker-1/+1
2011-08-03fix static linking dependency bloat with cancellationRich Felker-14/+21
previously, pthread_cleanup_push/pop were pulling in all of pthread_create due to dependency on the __pthread_unwind_next function. this was not needed, as cancellation cleanup handlers can never be called unless pthread_exit or pthread_cancel is reachable.
2011-08-03implement if_nameindex and if_freenameindexRich Felker-0/+65
2011-08-03overhaul rwlocks to address several issuesRich Felker-60/+44
like mutexes and semaphores, rwlocks suffered from a race condition where the unlock operation could access the lock memory after another thread successfully obtained the lock (and possibly destroyed or unmapped the object). this has been fixed in the same way it was fixed for other lock types. in addition, the previous implementation favored writers over readers. in the absence of other considerations, that is the best behavior for rwlocks, and posix explicitly allows it. however posix also requires read locks to be recursive. if writers are favored, any attempt to obtain a read lock while a writer is waiting for the lock will fail, causing "recursive" read locks to deadlock. this can be avoided by keeping track of which threads already hold read locks, but doing so requires unbounded memory usage, and there must be a fallback case that favors readers in case memory allocation failed. and all of this must be synchronized. the cost, complexity, and risk of errors in getting it right is too great, so we simply favor readers. tracking of the owner of write locks has been removed, as it was not useful for anything. it could allow deadlock detection, but it's not clear to me that returning EDEADLK (which a buggy program is likely to ignore) is better than deadlocking; at least the latter behavior prevents further data corruption. a correct program cannot invoke this situation anyway. the reader count and write lock state, as well as the "last minute" waiter flag have all been combined into a single atomic lock. this means all state transitions for the lock are atomic compare-and-swap operations. this makes establishing correctness much easier and may improve performance. finally, some code duplication has been cleaned up. more is called for, especially the standard __timedwait idiom repeated in all locks.
2011-08-03timedwait: play it safe for nowRich Felker-1/+1
it's unclear whether EINVAL or ENOSYS is used when the operation is not supported, so check for both...
2011-08-02fix stubbed-out reboot callRich Felker-3/+2
2011-08-02correctly handle old kernels without FUTEX_WAIT_BITSETRich Felker-1/+1
futex returns EINVAL, not ENOSYS, when op is not supported. unfortunately this looks just like EINVAL from other causes, and we end up running the fallback code and getting EINVAL again. fortunately this case should be rare since correct code should not generate EINVAL anyway.
2011-08-02fix sem_timedwait bug introduced in timedwait unificationRich Felker-0/+1
this dec used to be performed by the cancellation handler, which was called when popped.
2011-08-02unify and overhaul timed futex waitsRich Felker-53/+56
new features: - FUTEX_WAIT_BITSET op will be used for timed waits if available. this saves a call to clock_gettime. - error checking for the timespec struct is now inside __timedwait so it doesn't need to be duplicated everywhere. cond_timedwait still needs to duplicate it to avoid unlocking the mutex, though. - pushing and popping the cancellation handler is delegated to __timedwait, and cancellable/non-cancellable waits are unified.
2011-08-02avoid accessing mutex memory after atomic unlockRich Felker-34/+31
this change is needed to fix a race condition and ensure that it's possible to unlock and destroy or unmap the mutex as soon as pthread_mutex_lock succeeds. POSIX explicitly gives such an example in the rationale and requires an implementation to allow such usage.
2011-08-02fix breakage in cancellation due to signal functions overhaulRich Felker-1/+7
sigaddset was not accepting SIGCANCEL as a valid signal number.
2011-08-02overhaul posix semaphores to fix destructability raceRich Felker-27/+23
the race condition these changes address is described in glibc bug report number 12674: up until now, musl has shared the bug, and i had not been able to figure out how to eliminate it. in short, the problem is that it's not valid for sem_post to inspect the waiters count after incrementing the semaphore value, because another thread may have already successfully returned from sem_wait, (rightly) deemed itself the only remaining user of the semaphore, and chosen to destroy and free it (or unmap the shared memory it's stored in). POSIX is not explicit in blessing this usage, but it gives a very explicit analogous example with mutexes (which, in musl and glibc, also suffer from the same race condition bug) in the rationale for pthread_mutex_destroy. the new semaphore implementation augments the waiter count with a redundant waiter indication in the semaphore value itself, representing the presence of "last minute" waiters that may have arrived after sem_post read the waiter count. this allows sem_post to read the waiter count prior to incrementing the semaphore value, rather than after incrementing it, so as to avoid accessing the semaphore memory whatsoever after the increment takes place. a similar, but much simpler, fix should be possible for mutexes and other locking primitives whose usage rules are stricter than semaphores.
2011-08-01fix wrong messages in gai_strerrorRich Felker-0/+2
i had missed the fact that a couple values were unassigned...
2011-08-01port numbers should always be interpreted as decimalRich Felker-1/+1
per POSIX and RFC 3493: If the specified address family is AF_INET, AF_INET6, or AF_UNSPEC, the service can be specified as a string specifying a decimal port number. 021 is a valid decimal number, therefore, interpreting it as octal seems to be non-conformant.
2011-08-01fix crash in dns code with new stdio locking codeRich Felker-0/+1
2011-07-31consistency: use struct __ucontext instead of ucontext_t in prototypesRich Felker-1/+1
this is necessary to avoid build errors if feature test macros are not properly defined when including ucontext.h
2011-07-30fix race condition in sigqueueRich Felker-2/+8
this race is fundamentally due to linux's bogus requirement that userspace, rather than kernelspace, fill in the siginfo structure. an intervening signal handler that calls fork could cause both the parent and child process to send signals claiming to be from the parent, which could in turn have harmful effects depending on what the recipient does with the signal. we simply block all signals for the interval between getuid and sigqueue syscalls (much like what raise() does already) to prevent the race and make the getuid/sigqueue pair atomic. this will be a non-issue if linux is fixed to validate the siginfo structure or fill it in from kernelspace.
2011-07-30clean up pthread_sigmask/sigprocmask dependency orderRich Felker-11/+7
it's nicer for the function that doesn't use errno to be independent, and have the other one call it. saves some time and avoids clobbering errno.
2011-07-30fix some bugs in setxid and update setrlimit to use __synccallRich Felker-10/+33
setrlimit is supposed to be per-process, not per-thread, but again linux gets it wrong. work around this in userspace. not only is it needed for correctness; setxid also depends on the resource limits for all threads being the same to avoid situations where temporarily unlimiting the limit succeeds in some threads but fails in others.
2011-07-30add proper fuxed-based locking for stdioRich Felker-46/+71
previously, stdio used spinlocks, which would be unacceptable if we ever add support for thread priorities, and which yielded pathologically bad performance if an application attempted to use flockfile on a key file as a major/primary locking mechanism. i had held off on making this change for fear that it would hurt performance in the non-threaded case, but actually support for recursive locking had already inflicted that cost. by having the internal locking functions store a flag indicating whether they need to perform unlocking, rather than using the actual recursive lock counter, i was able to combine the conditionals at unlock time, eliminating any additional cost, and also avoid a nasty corner case where a huge number of calls to ftrylockfile could cause deadlock later at the point of internal locking. this commit also fixes some issues with usage of pthread_self conflicting with __attribute__((const)) which resulted in crashes with some compiler versions/optimizations, mainly in flockfile prior to pthread_create.
2011-07-30eliminate dependence of perror on printfRich Felker-10/+5
2011-07-30fix bug in synccall with no threads: lock was taken but never releasedRich Felker-4/+4
2011-07-29add setxid.c for new set*id() framework. missed in last commit.Rich Felker-0/+49
2011-07-29new attempt at making set*id() safe and robustRich Felker-130/+130
changing credentials in a multi-threaded program is extremely difficult on linux because it requires synchronizing the change between all threads, which have their own thread-local credentials on the kernel side. this is further complicated by the fact that changing the real uid can fail due to exceeding RLIMIT_NPROC, making it possible that the syscall will succeed in some threads but fail in others. the old __rsyscall approach being replaced was robust in that it would report failure if any one thread failed, but in this case, the program would be left in an inconsistent state where individual threads might have different uid. (this was not as bad as glibc, which would sometimes even fail to report the failure entirely!) the new approach being committed refuses to change real user id when it cannot temporarily set the rlimit to infinity. this is completely POSIX conformant since POSIX does not require an implementation to allow real-user-id changes for non-privileged processes whatsoever. still, setting the real uid can fail due to memory allocation in the kernel, but this can only happen if there is not already a cached object for the target user. thus, we forcibly serialize the syscalls attempts, and fail the entire operation on the first failure. this *should* lead to an all-or-nothing success/failure result, but it's still fragile and highly dependent on kernel developers not breaking things worse than they're already broken. ideally linux will eventually add a CLONE_USERCRED flag that would give POSIX conformant credential changes without any hacks from userspace, and all of this code would become redundant and could be removed ~10 years down the line when everyone has abandoned the old broken kernels. i'm not holding my breath...
2011-07-28remove ugly prng from mk*temp and just re-poll time on retryRich Felker-6/+5
2011-07-28eliminate mk*temp dependency on snprintfRich Felker-3/+4
this helps some tiny programs be even more tiny, and barly increases code size even if both are used.
2011-07-28fix for setenv bogus var argument handlingRich Felker-1/+1
thanks to mikachu per POSIX: The setenv() function shall fail if: [EINVAL] The name argument is a null pointer, points to an empty string, or points to a string containing an '=' character.
2011-07-25when resolving symbols with only weak defs, use first def, not last defRich Felker-0/+1
2011-07-25comment non-obvious de bruijn sequence code in int parserRich Felker-0/+2
2011-07-24fix resolution of weak symbols (hopefully right now) and vdsoRich Felker-3/+9
2011-07-24workaround for gcc's optimizer breaking dynamic symbol resolutionRich Felker-1/+2
2011-07-24load vdso, if present, into the dso listRich Felker-2/+31
2011-07-24const correctness on function pointerRich Felker-1/+1
2011-07-24simplify dynamic linker startupRich Felker-23/+17
instead of creating temp dso objects on the stack and moving them to the heap if dlopen/dlsym are used, use static objects to begin with, and just donate them to malloc if we no longer need them.
2011-07-23some preliminaries for vdso clock supportRich Felker-7/+35
these changes also make it so clock_gettime(CLOCK_REALTIME, &ts) works even on pre-2.6 kernels, emulated via the gettimeofday syscall. there is no cost for the fallback check, as it falls under the error case that already must be checked for storing the error code in errno, but which would normally be hidden inside __syscall_ret.
2011-07-22check for fd exhaustion in forkptyRich Felker-2/+15
we cannot report failure after forking, so the idea is to ensure prior to fork that fd 0,1,2 exist. this will prevent dup2 from possibly hitting a resource limit and failing in the child process. fcntl rather than dup2 is used prior to forking to avoid race conditions.
2011-07-22incorrect check for open failure in openpty functionRich Felker-1/+1
-1, not 0, indicates failure
2011-07-21socket headers macro adjustment - workaround for buggy programsRich Felker-2/+2
some program was undefining AF_NETLINK and thereby breaking AF_ROUTE...