Fund: sys$futex() is broken

The implementation first checks whether the value at the address still contains the value userspace expects, then goes to sleep. That is racy, since the value can be changed by another thread in between the check and the thread going to sleep. In fact, the whole point of FUTEX_WAIT having this argument is so that the kernel should (somehow) make this check without racing, since the userspace cannot.

serenity/Kernel/Syscalls/futex.cpp

Lines 50 to 68 in d410449

    
           i32 user_value; 
        
           if (!copy_from_user(&user_value, params.userspace_address)) 
        
               return -EFAULT; 
        
           if (user_value != params.val) 
        
               return -EAGAIN; 
        
           Thread::BlockTimeout timeout; 
        
           if (params.timeout) { 
        
               timespec ts_abstimeout { 0, 0 }; 
        
               if (!copy_from_user(&ts_abstimeout, params.timeout)) 
        
                   return -EFAULT; 
        
               timeout = Thread::BlockTimeout(true, &ts_abstimeout); 
        
           } 
        
           WaitQueue& wait_queue = futex_queue((FlatPtr)params.userspace_address); 
        
           Thread::BlockResult result = wait_queue.wait_on(timeout, "Futex"); 
        
           if (result == Thread::BlockResult::InterruptedByTimeout) { 
        
               return -ETIMEDOUT; 
        
           }

The happy path always returns 0, but at least FUTEX_WAKE is supposed to return the number of threads actually woken.

serenity/Kernel/Syscalls/futex.cpp

Line 83 in d410449

return 0;
If we want to port RWLock and CondVar from LWSP 😉, we need to support FUTEX_REQUEUE and FUTEX_WA{IT,KE}_BITSET

SerenityOS/serenity

sys$futex() is broken

How does funding with Polar work?

Backer

Contributor

Maintainer

	i32 user_value;
	if (!copy_from_user(&user_value, params.userspace_address))
	return -EFAULT;
	if (user_value != params.val)
	return -EAGAIN;

	Thread::BlockTimeout timeout;
	if (params.timeout) {
	timespec ts_abstimeout { 0, 0 };
	if (!copy_from_user(&ts_abstimeout, params.timeout))
	return -EFAULT;
	timeout = Thread::BlockTimeout(true, &ts_abstimeout);
	}

	WaitQueue& wait_queue = futex_queue((FlatPtr)params.userspace_address);
	Thread::BlockResult result = wait_queue.wait_on(timeout, "Futex");
	if (result == Thread::BlockResult::InterruptedByTimeout) {
	return -ETIMEDOUT;
	}

SerenityOS/serenity

sys$futex() is broken

How does funding with Polar work?

Backer

Why does "Fund on completion" require GitHub login?

When is the invoice due for "Fund on completion"?

What happens if the issue is never completed?

Do I get any extra benefits by funding?

Do I get progress updates?

Contributor

Do I get a reward?

Is rewards guaranteed?

Maintainer

How can I get funding like this for my open source initiatives?