DF-2787
mtx_notlocked_ex() returns the exact opposite of its documented contract (inverted exclusive-lock test in shipped header)
| Field | Value |
|---|---|
| ID | DF-2787 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-628 Functionally Incorrect Contract Implementation |
| File | sys/kern/kern_mutex.c |
| Lines | mutex2.h:436-442 (header consumer of this file's locking) |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
The comment says "Return TRUE (non-zero) if the mutex is not locked
exclusively" but the implementation returns ((mtx->mtx_lock &
MTX_EXCLUSIVE) != 0) — TRUE when the mutex IS exclusively locked.
Zero in-tree callers (only the correct sibling mtx_notlocked() is
used), so a latent API trap, not a live defect.
Recommended fix
Invert the test to == 0 (matches the contract and the mtx_notlocked()
naming convention).
Timeline
- 2026-08-31 Discovered during pass-2 audit of kern_mutex.c (GLM 5.3).
No comments yet.