AgeCommit message (Collapse)AuthorLines
2011-08-06ensure the compiler does not move around thread-register-based readsRich Felker-2/+2
if gcc decided to move this across a conditional that checks validity of the thread register, an invalid thread-register-based read could be performed and raise sigsegv.
2011-08-06simplify multi-threaded errno, eliminate useless function pointerRich Felker-12/+5
2011-08-06use weak aliases rather than function pointers to simplify some codeRich Felker-9/+20
2011-08-05fix off-by-one bug in siglongjmp that caused unpredictable behaviorRich Felker-1/+1
if saved, signal mask would not be restored unless some low signals were masked. if not saved, signal mask could be wrongly restored to uninitialized values. in any, wrong mask would be restored. i believe this function was written for a very old version of the jmp_buf structure which did not contain a final 0 field for compatibility with siglongjmp, and never updated...
2011-08-03further debloat cancellation handlersRich Felker-17/+30
cleanup push and pop are also no-ops if pthread_exit is not reachable. this can make a big difference for library code which needs to protect itself against cancellation, but which is unlikely to actually be used in programs with threads/cancellation.
2011-08-03missed detail in cancellation bloat fixRich Felker-1/+1
2011-08-03fix static linking dependency bloat with cancellationRich Felker-14/+21
previously, pthread_cleanup_push/pop were pulling in all of pthread_create due to dependency on the __pthread_unwind_next function. this was not needed, as cancellation cleanup handlers can never be called unless pthread_exit or pthread_cancel is reachable.
2011-08-03implement if_nameindex and if_freenameindexRich Felker-0/+65
2011-08-03overhaul rwlocks to address several issuesRich Felker-60/+44
like mutexes and semaphores, rwlocks suffered from a race condition where the unlock operation could access the lock memory after another thread successfully obtained the lock (and possibly destroyed or unmapped the object). this has been fixed in the same way it was fixed for other lock types. in addition, the previous implementation favored writers over readers. in the absence of other considerations, that is the best behavior for rwlocks, and posix explicitly allows it. however posix also requires read locks to be recursive. if writers are favored, any attempt to obtain a read lock while a writer is waiting for the lock will fail, causing "recursive" read locks to deadlock. this can be avoided by keeping track of which threads already hold read locks, but doing so requires unbounded memory usage, and there must be a fallback case that favors readers in case memory allocation failed. and all of this must be synchronized. the cost, complexity, and risk of errors in getting it right is too great, so we simply favor readers. tracking of the owner of write locks has been removed, as it was not useful for anything. it could allow deadlock detection, but it's not clear to me that returning EDEADLK (which a buggy program is likely to ignore) is better than deadlocking; at least the latter behavior prevents further data corruption. a correct program cannot invoke this situation anyway. the reader count and write lock state, as well as the "last minute" waiter flag have all been combined into a single atomic lock. this means all state transitions for the lock are atomic compare-and-swap operations. this makes establishing correctness much easier and may improve performance. finally, some code duplication has been cleaned up. more is called for, especially the standard __timedwait idiom repeated in all locks.
2011-08-03timedwait: play it safe for nowRich Felker-1/+1
it's unclear whether EINVAL or ENOSYS is used when the operation is not supported, so check for both...
2011-08-02fix stubbed-out reboot callRich Felker-3/+2
2011-08-02correctly handle old kernels without FUTEX_WAIT_BITSETRich Felker-1/+1
futex returns EINVAL, not ENOSYS, when op is not supported. unfortunately this looks just like EINVAL from other causes, and we end up running the fallback code and getting EINVAL again. fortunately this case should be rare since correct code should not generate EINVAL anyway.
2011-08-02fix sem_timedwait bug introduced in timedwait unificationRich Felker-0/+1
this dec used to be performed by the cancellation handler, which was called when popped.
2011-08-02unify and overhaul timed futex waitsRich Felker-53/+56
new features: - FUTEX_WAIT_BITSET op will be used for timed waits if available. this saves a call to clock_gettime. - error checking for the timespec struct is now inside __timedwait so it doesn't need to be duplicated everywhere. cond_timedwait still needs to duplicate it to avoid unlocking the mutex, though. - pushing and popping the cancellation handler is delegated to __timedwait, and cancellable/non-cancellable waits are unified.
2011-08-02avoid accessing mutex memory after atomic unlockRich Felker-34/+31
this change is needed to fix a race condition and ensure that it's possible to unlock and destroy or unmap the mutex as soon as pthread_mutex_lock succeeds. POSIX explicitly gives such an example in the rationale and requires an implementation to allow such usage.
2011-08-02fix breakage in cancellation due to signal functions overhaulRich Felker-1/+7
sigaddset was not accepting SIGCANCEL as a valid signal number.
2011-08-02overhaul posix semaphores to fix destructability raceRich Felker-27/+23
the race condition these changes address is described in glibc bug report number 12674: up until now, musl has shared the bug, and i had not been able to figure out how to eliminate it. in short, the problem is that it's not valid for sem_post to inspect the waiters count after incrementing the semaphore value, because another thread may have already successfully returned from sem_wait, (rightly) deemed itself the only remaining user of the semaphore, and chosen to destroy and free it (or unmap the shared memory it's stored in). POSIX is not explicit in blessing this usage, but it gives a very explicit analogous example with mutexes (which, in musl and glibc, also suffer from the same race condition bug) in the rationale for pthread_mutex_destroy. the new semaphore implementation augments the waiter count with a redundant waiter indication in the semaphore value itself, representing the presence of "last minute" waiters that may have arrived after sem_post read the waiter count. this allows sem_post to read the waiter count prior to incrementing the semaphore value, rather than after incrementing it, so as to avoid accessing the semaphore memory whatsoever after the increment takes place. a similar, but much simpler, fix should be possible for mutexes and other locking primitives whose usage rules are stricter than semaphores.
2011-08-01fix wrong messages in gai_strerrorRich Felker-0/+2
i had missed the fact that a couple values were unassigned...
2011-08-01port numbers should always be interpreted as decimalRich Felker-1/+1
per POSIX and RFC 3493: If the specified address family is AF_INET, AF_INET6, or AF_UNSPEC, the service can be specified as a string specifying a decimal port number. 021 is a valid decimal number, therefore, interpreting it as octal seems to be non-conformant.
2011-08-01fix crash in dns code with new stdio locking codeRich Felker-0/+1
2011-07-31consistency: use struct __ucontext instead of ucontext_t in prototypesRich Felker-1/+1
this is necessary to avoid build errors if feature test macros are not properly defined when including ucontext.h
2011-07-30fix race condition in sigqueueRich Felker-2/+8
this race is fundamentally due to linux's bogus requirement that userspace, rather than kernelspace, fill in the siginfo structure. an intervening signal handler that calls fork could cause both the parent and child process to send signals claiming to be from the parent, which could in turn have harmful effects depending on what the recipient does with the signal. we simply block all signals for the interval between getuid and sigqueue syscalls (much like what raise() does already) to prevent the race and make the getuid/sigqueue pair atomic. this will be a non-issue if linux is fixed to validate the siginfo structure or fill it in from kernelspace.
2011-07-30clean up pthread_sigmask/sigprocmask dependency orderRich Felker-11/+7
it's nicer for the function that doesn't use errno to be independent, and have the other one call it. saves some time and avoids clobbering errno.
2011-07-30fix some bugs in setxid and update setrlimit to use __synccallRich Felker-10/+33
setrlimit is supposed to be per-process, not per-thread, but again linux gets it wrong. work around this in userspace. not only is it needed for correctness; setxid also depends on the resource limits for all threads being the same to avoid situations where temporarily unlimiting the limit succeeds in some threads but fails in others.
2011-07-30add proper fuxed-based locking for stdioRich Felker-46/+71
previously, stdio used spinlocks, which would be unacceptable if we ever add support for thread priorities, and which yielded pathologically bad performance if an application attempted to use flockfile on a key file as a major/primary locking mechanism. i had held off on making this change for fear that it would hurt performance in the non-threaded case, but actually support for recursive locking had already inflicted that cost. by having the internal locking functions store a flag indicating whether they need to perform unlocking, rather than using the actual recursive lock counter, i was able to combine the conditionals at unlock time, eliminating any additional cost, and also avoid a nasty corner case where a huge number of calls to ftrylockfile could cause deadlock later at the point of internal locking. this commit also fixes some issues with usage of pthread_self conflicting with __attribute__((const)) which resulted in crashes with some compiler versions/optimizations, mainly in flockfile prior to pthread_create.
2011-07-30eliminate dependence of perror on printfRich Felker-10/+5
2011-07-30fix bug in synccall with no threads: lock was taken but never releasedRich Felker-4/+4
2011-07-29add setxid.c for new set*id() framework. missed in last commit.Rich Felker-0/+49
2011-07-29new attempt at making set*id() safe and robustRich Felker-130/+130
changing credentials in a multi-threaded program is extremely difficult on linux because it requires synchronizing the change between all threads, which have their own thread-local credentials on the kernel side. this is further complicated by the fact that changing the real uid can fail due to exceeding RLIMIT_NPROC, making it possible that the syscall will succeed in some threads but fail in others. the old __rsyscall approach being replaced was robust in that it would report failure if any one thread failed, but in this case, the program would be left in an inconsistent state where individual threads might have different uid. (this was not as bad as glibc, which would sometimes even fail to report the failure entirely!) the new approach being committed refuses to change real user id when it cannot temporarily set the rlimit to infinity. this is completely POSIX conformant since POSIX does not require an implementation to allow real-user-id changes for non-privileged processes whatsoever. still, setting the real uid can fail due to memory allocation in the kernel, but this can only happen if there is not already a cached object for the target user. thus, we forcibly serialize the syscalls attempts, and fail the entire operation on the first failure. this *should* lead to an all-or-nothing success/failure result, but it's still fragile and highly dependent on kernel developers not breaking things worse than they're already broken. ideally linux will eventually add a CLONE_USERCRED flag that would give POSIX conformant credential changes without any hacks from userspace, and all of this code would become redundant and could be removed ~10 years down the line when everyone has abandoned the old broken kernels. i'm not holding my breath...
2011-07-28remove ugly prng from mk*temp and just re-poll time on retryRich Felker-6/+5
2011-07-28eliminate mk*temp dependency on snprintfRich Felker-3/+4
this helps some tiny programs be even more tiny, and barly increases code size even if both are used.
2011-07-28fix for setenv bogus var argument handlingRich Felker-1/+1
thanks to mikachu per POSIX: The setenv() function shall fail if: [EINVAL] The name argument is a null pointer, points to an empty string, or points to a string containing an '=' character.
2011-07-25when resolving symbols with only weak defs, use first def, not last defRich Felker-0/+1
2011-07-25comment non-obvious de bruijn sequence code in int parserRich Felker-0/+2
2011-07-24fix resolution of weak symbols (hopefully right now) and vdsoRich Felker-3/+9
2011-07-24workaround for gcc's optimizer breaking dynamic symbol resolutionRich Felker-1/+2
2011-07-24load vdso, if present, into the dso listRich Felker-2/+31
2011-07-24const correctness on function pointerRich Felker-1/+1
2011-07-24simplify dynamic linker startupRich Felker-23/+17
instead of creating temp dso objects on the stack and moving them to the heap if dlopen/dlsym are used, use static objects to begin with, and just donate them to malloc if we no longer need them.
2011-07-23some preliminaries for vdso clock supportRich Felker-7/+35
these changes also make it so clock_gettime(CLOCK_REALTIME, &ts) works even on pre-2.6 kernels, emulated via the gettimeofday syscall. there is no cost for the fallback check, as it falls under the error case that already must be checked for storing the error code in errno, but which would normally be hidden inside __syscall_ret.
2011-07-22check for fd exhaustion in forkptyRich Felker-2/+15
we cannot report failure after forking, so the idea is to ensure prior to fork that fd 0,1,2 exist. this will prevent dup2 from possibly hitting a resource limit and failing in the child process. fcntl rather than dup2 is used prior to forking to avoid race conditions.
2011-07-22incorrect check for open failure in openpty functionRich Felker-1/+1
-1, not 0, indicates failure
2011-07-21socket headers macro adjustment - workaround for buggy programsRich Felker-2/+2
some program was undefining AF_NETLINK and thereby breaking AF_ROUTE...
2011-07-21fix errno value when fdopendir is given an invalid file descriptorRich Felker-1/+4
this resolves an issue reported by Vasiliy Kulikov
2011-07-16ensure in fork that child gets its own new robust mutex listRich Felker-0/+1
2011-07-16fix logic error in freadRich Felker-6/+1
fread was calling f->read without checking that the file was in reading mode. this could: 1. crash, if f->read was a null pointer 2. cause unwanted blocking on a terminal already at eof 3. allow reading on a write-only file
2011-07-14fix various bugs in new integer parser frameworkRich Felker-10/+15
1. my interpretation of subject sequence definition was wrong. adjust parser to conform to the standard. 2. some code for handling tail overflow case was missing (forgot to finish writing it). 3. typo (= instead of ==) caused ERANGE to wrongly behave like EINVAL
2011-07-14fix wcsto[iu]max with high charactersRich Felker-4/+2
stopping without letting the parser see a stop character prevented getting a result. so treat all high chars as the null character and pass them into the parser. also eliminated ugly tmp var using compound literals.
2011-07-14new restartable integer parsing framework.Rich Felker-156/+197
this fixes a number of bugs in integer parsing due to lazy haphazard wrapping, as well as some misinterpretations of the standard. the new parser is able to work character-at-a-time or on whole strings, making it easy to support the wide functions without unbounded space for conversion. it will also be possible to update scanf to use the new parser.
2011-07-12gb18030 support in iconv (only from, not to)Rich Felker-2/+1887
also support (and restrict to subsets) older chinese sets, and explicitly refuse to convert to cjk (since there's no code for it yet)