freebsd-dev/sys/kern
Konstantin Belousov 6690381ef1 The dependency chain for priority-inheritance mutexes could be
subverted by userspace into cycle.  Both umtx_propagate_priority() and
umtx_repropagate_priority() would then loop infinitely, owning the
spinlock.

Check for the cycle using standard Floyd' algorithm before doing the
pass in the affected functions.  Add simple check for condition of
tricking the thread into a wait for itself, which could be easily
simulated by usermode without race.

Found by:	Eric van Gyzen <eric@vangyzen.net>
In collaboration with:	Eric van Gyzen <eric@vangyzen.net>
Tested by:	pho
MFC after:	1 week
2015-01-31 12:27:40 +00:00
..
bus_if.m Add a bus method to fetch the VM domain for the given device/bus. 2014-10-09 05:33:25 +00:00
capabilities.conf Add futimens and utimensat system calls. 2015-01-23 21:07:08 +00:00
clock_if.m
cpufreq_if.m
device_if.m Change the default method for device_quiesce() to return 0 instead of 2015-01-08 21:46:28 +00:00
genassym.sh
imgact_aout.c
imgact_binmisc.c Allow multiple image activators to run on the same execution by changing 2014-09-04 21:31:25 +00:00
imgact_elf32.c
imgact_elf64.c
imgact_elf.c The size value should be asserted when it is known. 2014-11-22 18:15:02 +00:00
imgact_gzip.c Add a mmap flag (MAP_32BIT) on 64-bit platforms to request that a mapping use 2013-09-09 18:11:59 +00:00
imgact_shell.c Allow multiple image activators to run on the same execution by changing 2014-09-04 21:31:25 +00:00
inflate.c
init_main.c Revert for r277213: 2015-01-22 11:12:42 +00:00
init_sysent.c Run make sysent. 2015-01-23 21:08:24 +00:00
kern_acct.c
kern_alq.c Prevent alq from panic when the invalid alq_file path specified. 2014-04-05 16:54:47 +00:00
kern_clock.c The process spin lock currently has the following distinct uses: 2014-11-26 14:10:00 +00:00
kern_clocksource.c On some Intel CPUs with a P-state but not C-state invariant TSC the TSC 2015-01-05 20:44:44 +00:00
kern_condvar.c Revert for r277213: 2015-01-22 11:12:42 +00:00
kern_conf.c Stop enforcing additional reference on all cdevs, which was introduced 2015-01-19 17:36:52 +00:00
kern_cons.c Rework r276532 a bit. Always avoid recursing into the console drivers 2015-01-03 17:21:19 +00:00
kern_context.c
kern_cpu.c Pull in r267961 and r267973 again. Fix for issues reported will follow. 2014-06-28 03:56:17 +00:00
kern_cpuset.c Reject attempts to read the cpuset mask of a negative domain ID. 2015-01-08 19:11:14 +00:00
kern_ctf.c
kern_descrip.c filedesc: avoid spurious copying of capabilities in fget_unlocked 2015-01-21 18:32:53 +00:00
kern_dtrace.c Commit the rest of the changes that were intended to be part of r266826. 2014-05-29 01:42:22 +00:00
kern_dump.c Factor out duplicated code from dumpsys() on each architecture into generic 2015-01-07 01:01:39 +00:00
kern_environment.c Test if 'env' is NULL before doing memset() and strlen(), 2014-10-23 18:23:50 +00:00
kern_et.c Fix build breakage. Apparently all ARM configs build kern_et.c, but only a 2014-04-02 17:34:17 +00:00
kern_event.c prevent doing filter ops locking for staticly compiled filter ops... 2014-11-16 01:18:41 +00:00
kern_exec.c Add procctl(2) PROC_TRACE_CTL command to enable or disable debugger 2015-01-18 15:13:11 +00:00
kern_exit.c Add a facility for non-init process to declare itself the reaper of 2014-12-15 12:01:42 +00:00
kern_fail.c
kern_ffclock.c The SYSCTL data pointers can come from userspace and must not be 2014-10-28 12:00:39 +00:00
kern_fork.c Add procctl(2) PROC_TRACE_CTL command to enable or disable debugger 2015-01-18 15:13:11 +00:00
kern_gzio.c
kern_hhook.c
kern_idle.c
kern_intr.c This is the much-discussed major upgrade to the random(4) device, known to you all as /dev/random. 2014-10-30 21:21:53 +00:00
kern_jail.c Add allow.mount.fdescfs jail flag. 2015-01-28 21:08:09 +00:00
kern_khelp.c
kern_kthread.c Do not use potentially stale thread in kthread_add() 2013-08-17 17:02:43 +00:00
kern_ktr.c Drop KTR records when we're in the debugger so that the debugger isn't 2014-07-02 22:13:07 +00:00
kern_ktrace.c Pull in r267961 and r267973 again. Fix for issues reported will follow. 2014-06-28 03:56:17 +00:00
kern_linker.c Const poison in a few places to ensure we don't modify things 2014-12-03 22:14:13 +00:00
kern_lock.c Revert for r277213: 2015-01-22 11:12:42 +00:00
kern_lockf.c Improve style and fix a possible use-after-free case introduced in r268384 2015-01-10 06:48:35 +00:00
kern_lockstat.c - For kernel compiled only with KDTRACE_HOOKS and not any lock debugging 2013-11-25 07:38:45 +00:00
kern_loginclass.c Simplify sys_getloginclass. 2014-10-28 04:59:33 +00:00
kern_malloc.c svn revisions r269964 and r269963 seemed to have impaired small memory 2014-09-22 05:07:22 +00:00
kern_mbuf.c Test for absence of M_NOFREE before attempting to purge the mbuf's tags. 2014-09-30 23:16:26 +00:00
kern_mib.c Fix multiple incorrect SYSCTL arguments in the kernel: 2014-10-21 07:31:21 +00:00
kern_module.c
kern_mtxpool.c Garbage collect mtxpool_lockbuilder, the mutex pool historically used 2014-05-02 07:57:40 +00:00
kern_mutex.c Add _NEW flag to mtx(9), sx(9), rmlock(9) and rwlock(9). 2014-12-13 21:00:10 +00:00
kern_ntptime.c Pull in r267961 and r267973 again. Fix for issues reported will follow. 2014-06-28 03:56:17 +00:00
kern_osd.c Pull in r267961 and r267973 again. Fix for issues reported will follow. 2014-06-28 03:56:17 +00:00
kern_physio.c Fix some issues in change 254760 pointed out by Bruce Evans: 2013-08-29 16:41:40 +00:00
kern_pmc.c Pull in r267961 and r267973 again. Fix for issues reported will follow. 2014-06-28 03:56:17 +00:00
kern_poll.c - Remove empty wrappers ether_poll_[de]register_drv(). [1] 2014-09-28 14:05:18 +00:00
kern_priv.c Pull in r267961 and r267973 again. Fix for issues reported will follow. 2014-06-28 03:56:17 +00:00
kern_proc.c Fix gcc build. 2014-12-14 08:43:13 +00:00
kern_procctl.c Add procctl(2) PROC_TRACE_CTL command to enable or disable debugger 2015-01-18 15:13:11 +00:00
kern_prot.c Add procctl(2) PROC_TRACE_CTL command to enable or disable debugger 2015-01-18 15:13:11 +00:00
kern_racct.c The process spin lock currently has the following distinct uses: 2014-11-26 14:10:00 +00:00
kern_rangelock.c Change the queue of locks in kern_rangelock.c from holding lock requests in 2013-08-15 20:19:17 +00:00
kern_rctl.c
kern_resource.c The process spin lock currently has the following distinct uses: 2014-11-26 14:10:00 +00:00
kern_rmlock.c Add _NEW flag to mtx(9), sx(9), rmlock(9) and rwlock(9). 2014-12-13 21:00:10 +00:00
kern_rwlock.c Add _NEW flag to mtx(9), sx(9), rmlock(9) and rwlock(9). 2014-12-13 21:00:10 +00:00
kern_sdt.c Print a backtrace if the SDT(9) stub gets called so that there's at least 2014-02-22 01:41:45 +00:00
kern_sema.c
kern_sharedpage.c Remove the deprecated VM_ALLOC_RETRY flag for the vm_page_grab(9). 2013-08-22 07:39:53 +00:00
kern_shutdown.c Factor out duplicated code from dumpsys() on each architecture into generic 2015-01-07 01:01:39 +00:00
kern_sig.c Add procctl(2) PROC_TRACE_CTL command to enable or disable debugger 2015-01-18 15:13:11 +00:00
kern_switch.c Revert for r277213: 2015-01-22 11:12:42 +00:00
kern_sx.c Add _NEW flag to mtx(9), sx(9), rmlock(9) and rwlock(9). 2014-12-13 21:00:10 +00:00
kern_synch.c Revert for r277213: 2015-01-22 11:12:42 +00:00
kern_syscalls.c Fix up module unload for syscall_module_handler consumers. 2014-11-01 22:36:40 +00:00
kern_sysctl.c sysctl: don't modify oid_running for static nodes 2014-12-28 19:24:01 +00:00
kern_tc.c Update the vdso timehands only via tc_windup(). 2015-01-20 03:54:30 +00:00
kern_thr.c Clean up confusing comment. Move it to the place of code which is 2014-11-03 11:29:08 +00:00
kern_thread.c Revert for r277213: 2015-01-22 11:12:42 +00:00
kern_time.c Fix an off by one in ppsratecheck(). If you asked for N=1 you'd get one, 2015-01-11 20:48:29 +00:00
kern_timeout.c Call WITNESS_WARN() in callout_drain() to check whether any locks are 2015-01-26 04:04:57 +00:00
kern_umtx.c The dependency chain for priority-inheritance mutexes could be 2015-01-31 12:27:40 +00:00
kern_uuid.c Fix a bug in be_uuid_dec(); it called le16dec() instead of be16dec(), 2014-02-13 22:24:36 +00:00
kern_xxx.c
ksched.c
link_elf_obj.c Fully support constructors for the purpose of code coverage analysis. 2014-10-20 17:04:03 +00:00
link_elf.c Fully support constructors for the purpose of code coverage analysis. 2014-10-20 17:04:03 +00:00
linker_if.m
Make.tags.inc Remove AppleTalk support. 2014-03-14 06:29:43 +00:00
Makefile
makesyscalls.sh Fix syscalls that can be loaded as kernel modules - they were not given 2013-12-15 23:19:42 +00:00
md4c.c
md5c.c
p1003_1b.c
posix4_mib.c
sched_4bsd.c Restore pre-r239157 handling of sched_yield(), when thread time slice was 2014-08-23 17:31:56 +00:00
sched_ule.c Update the ULE scheduler + thread and kinfo structs to use int for cpuid 2014-10-18 19:36:11 +00:00
serdev_if.m
stack_protector.c
subr_acl_nfs4.c
subr_acl_posix1e.c
subr_autoconf.c
subr_blist.c
subr_bufring.c
subr_bus_dma.c Add bus_dmamap_load_ma() function to load map with the array of 2013-10-27 21:39:16 +00:00
subr_bus.c Trim trailing whitespace. 2015-01-05 20:50:44 +00:00
subr_busdma_bufalloc.c Replace kernel virtual address space allocation with vmem. This provides 2013-08-07 06:21:20 +00:00
subr_capability.c Remove duplicated includes. 2014-06-26 13:57:44 +00:00
subr_clock.c For architectures where time_t is wide enough, in particular, 64bit 2014-12-12 09:37:18 +00:00
subr_counter.c Create two public UMA_ZONE_PCPU zones: 64 bit sized and pointer sized. 2014-02-10 19:59:46 +00:00
subr_devstat.c Fix multiple incorrect SYSCTL arguments in the kernel: 2014-10-21 07:31:21 +00:00
subr_disk.c
subr_dummy_vdso_tc.c Update the vdso timehands only via tc_windup(). 2015-01-20 03:54:30 +00:00
subr_eventhandler.c
subr_fattime.c Where appropriate, use the modern terms for the one true time base 2014-12-21 05:07:11 +00:00
subr_firmware.c
subr_hash.c
subr_hints.c Follow up to r225617. In order to maximize the re-usability of kernel code 2014-10-16 18:04:43 +00:00
subr_kdb.c Fix multiple incorrect SYSCTL arguments in the kernel: 2014-10-21 07:31:21 +00:00
subr_kobj.c
subr_lock.c Add _NEW flag to mtx(9), sx(9), rmlock(9) and rwlock(9). 2014-12-13 21:00:10 +00:00
subr_log.c
subr_mbpool.c All mbuf external free functions never fail, so let them be void. 2014-07-11 13:58:48 +00:00
subr_mchain.c
subr_module.c Turns out, this isn't only called from i386... 2014-12-30 02:39:47 +00:00
subr_msgbuf.c Pull in r267961 and r267973 again. Fix for issues reported will follow. 2014-06-28 03:56:17 +00:00
subr_param.c Rework virtual machine hypervisor detection. 2014-10-28 19:17:44 +00:00
subr_pcpu.c Create two public UMA_ZONE_PCPU zones: 64 bit sized and pointer sized. 2014-02-10 19:59:46 +00:00
subr_pctrie.c
subr_power.c
subr_prf.c Fix usage example in kvprintf(9) and its copy in libstand(3): trailing '\n' 2015-01-23 07:30:57 +00:00
subr_prof.c The process spin lock currently has the following distinct uses: 2014-11-26 14:10:00 +00:00
subr_rman.c Nuke the never-used RF_TIMESHARE feature, reducing the complexity of the 2014-07-16 22:18:19 +00:00
subr_rtc.c
subr_sbuf.c Unbreak the ABI by reverting r268494 until the compat shims are provided 2014-07-28 07:20:22 +00:00
subr_scanf.c
subr_sfbuf.c Move KASSERT into locked region. 2014-08-11 15:06:07 +00:00
subr_sglist.c Fix a couple of panics when detaching from a cxgbe/cxl interface that was 2015-01-26 16:26:28 +00:00
subr_sleepqueue.c Revert for r277213: 2015-01-22 11:12:42 +00:00
subr_smp.c Pull in r267961 and r267973 again. Fix for issues reported will follow. 2014-06-28 03:56:17 +00:00
subr_stack.c
subr_syscall.c Thread waiting for the vfork(2)-ed child to exec or exit, must allow 2014-12-08 16:18:05 +00:00
subr_taskqueue.c Prevent live-lock and access of destroyed data in taskqueue_drain_all(). 2015-01-04 19:55:44 +00:00
subr_terminal.c vt(4): Adjust the cursor position after changing the window size 2014-11-01 17:05:15 +00:00
subr_trap.c Revert r263475: TDP_DEVMEMIO no longer needed, since amd64 /dev/kmem 2015-01-12 08:58:07 +00:00
subr_turnstile.c dtrace sdt: remove the ugly sname parameter of SDT_PROBE_DEFINE 2013-11-26 08:46:27 +00:00
subr_uio.c Add type qualifier volatile to the base (userspace) address argument 2014-10-31 17:43:21 +00:00
subr_unit.c Move the definition of the struct unrhdr into a separate header file, 2013-08-30 07:37:45 +00:00
subr_vmem.c Do not set M_BESTFIT if a strategy has already been provided. This 2014-04-16 21:39:43 +00:00
subr_witness.c Fix a typo from r189544, which replaced unp_global_rwlock with unp_list_lock 2014-10-20 20:21:40 +00:00
sys_capability.c Use crcopysafe(9) to make a copy of a process' credential struct. crcopy(9) 2015-01-05 23:07:22 +00:00
sys_generic.c Style changes: 2014-11-28 09:32:07 +00:00
sys_pipe.c Do not assert that the new pipepair mutex is not initialized. The 2015-01-21 16:32:54 +00:00
sys_procdesc.c Add a new fo_fill_kinfo fileops method to add type-specific information to 2014-09-22 16:20:47 +00:00
sys_process.c Add a facility for non-init process to declare itself the reaper of 2014-12-15 12:01:42 +00:00
sys_socket.c In preparation of merging projects/sendfile, transform bare access to 2014-11-12 09:57:15 +00:00
syscalls.c Run make sysent. 2015-01-23 21:08:24 +00:00
syscalls.master Add futimens and utimensat system calls. 2015-01-23 21:07:08 +00:00
systrace_args.c Run make sysent. 2015-01-23 21:08:24 +00:00
sysv_ipc.c
sysv_msg.c Avoid dynamic syscall overhead for statically compiled modules. 2014-10-26 19:42:44 +00:00
sysv_sem.c Avoid dynamic syscall overhead for statically compiled modules. 2014-10-26 19:42:44 +00:00
sysv_shm.c Avoid dynamic syscall overhead for statically compiled modules. 2014-10-26 19:42:44 +00:00
tty_compat.c
tty_info.c
tty_inq.c
tty_outq.c
tty_pts.c Implement FIODTYPE for master ptys. 2014-10-15 12:38:26 +00:00
tty_tty.c
tty_ttydisc.c
tty.c Fix draining in ttydev_leave(): 2014-10-09 02:30:38 +00:00
uipc_accf.c The accept filter code is not specific to the FreeBSD IPv4 network stack, 2014-07-26 19:27:34 +00:00
uipc_debug.c Merge from projects/sendfile: 2014-11-30 12:52:33 +00:00
uipc_domain.c Merge from projects/sendfile: extend protocols API to support 2014-11-30 13:24:21 +00:00
uipc_mbuf2.c Remove a 'This is dumb' comment that has been incorrect for at least a 2015-01-09 12:08:51 +00:00
uipc_mbuf.c In order to support ongoing work to implement variable-size mbufs, and 2015-01-14 23:44:00 +00:00
uipc_mqueue.c Avoid dynamic syscall overhead for statically compiled modules. 2014-10-26 19:42:44 +00:00
uipc_sem.c Avoid dynamic syscall overhead for statically compiled modules. 2014-10-26 19:42:44 +00:00
uipc_shm.c Add a new fo_fill_kinfo fileops method to add type-specific information to 2014-09-22 16:20:47 +00:00
uipc_sockbuf.c In sbappend*() family of functions clear M_PROTO flags of incoming 2014-12-22 15:39:24 +00:00
uipc_socket.c Revert r274494, r274712, r275955 and provide extra comments explaining 2014-12-20 22:12:04 +00:00
uipc_syscalls.c Remove the no-at variants of the kern_xx() syscall helpers. E.g., we 2014-11-13 18:01:51 +00:00
uipc_usrreq.c The VOP_LOOKUP() implementations for CREATE op do not put the name 2014-12-18 10:01:12 +00:00
vfs_acl.c Replace some calls to fuword() by fueword() with proper error checking. 2014-10-28 15:28:20 +00:00
vfs_aio.c Avoid dynamic syscall overhead for statically compiled modules. 2014-10-26 19:42:44 +00:00
vfs_bio.c When getnewbuf_reuse_bp() is called to reclaim some (clean) buffer, 2014-12-08 16:42:34 +00:00
vfs_cache.c Indeed, instead of hiding the kern___getcwd() bug by bogus cast 2015-01-04 10:34:02 +00:00
vfs_cluster.c When allocating a pbuf for the cluster write, do not sleep waiting 2013-08-27 01:31:12 +00:00
vfs_default.c Fix the comment introduced in r276192 so that it clearly 2014-12-25 14:44:04 +00:00
vfs_export.c After the changes in r274118 make NOIP kernels compile by hiding an 2014-11-06 12:19:39 +00:00
vfs_extattr.c Update kernel inclusions of capability.h to use capsicum.h instead; some 2014-03-16 10:55:57 +00:00
vfs_hash.c Convert vfs hash lock from a mutex to an rwlock. 2014-12-30 21:40:45 +00:00
vfs_init.c Rename sysctl_lock and _unlock to sysctl_xlock and _xunlock. 2014-10-21 19:02:26 +00:00
vfs_lookup.c Fix two issues with lockmgr(9) LK_CAN_SHARE() test, which determines 2014-11-02 13:10:31 +00:00
vfs_mount.c Do not call VFS_SYNC() before VFS_UNMOUNT() for forced unmount. 2014-12-09 10:00:47 +00:00
vfs_mountroot.c Remove the no-at variants of the kern_xx() syscall helpers. E.g., we 2014-11-13 18:01:51 +00:00
vfs_subr.c Change the default VFS timestamp precision from seconds to microseconds. 2015-01-25 19:56:45 +00:00
vfs_syscalls.c Add futimens and utimensat system calls. 2015-01-23 21:07:08 +00:00
vfs_vnops.c Add VN_OPEN_NAMECACHE flag for vn_open_cred(9), which requests that 2014-12-21 13:32:07 +00:00
vnode_if.src Merge from projects/sendfile: 2014-11-23 12:01:52 +00:00