DragonFlyBSD Kernel Audit
DF-0203 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/kern/kern_umtx.c b/sys/kern/kern_umtx.c
--- a/sys/kern/kern_umtx.c
+++ b/sys/kern/kern_umtx.c
@@ -147,6 +147,9 @@
 	waddr = (void *)(intptr_t)uservtophys((intptr_t)uptr);
     } while (waddr == (void *)(intptr_t)-1 && value != -1);
 
+    /* NOTE: fuwordadd32() returns -1 on fault, so a genuine mutex value
+     * of -1 is indistinguishable from a translation fault here.  Callers
+     * that need a reliable protocol should avoid using -1 as a token. */
     if (value == -1 && waddr == (void *)(intptr_t)-1) {
 	kprintf("umtx_sleep() (A): WARNING can't translate %p (%s %d/%d)\n",
 		uptr, td->td_comm,