check mutex owner in pthread_cond_wait

when used with error-checking mutexes, pthread_cond_wait is required
to fail with EPERM if the mutex is not locked by the caller.
previously we relied on pthread_mutex_unlock to generate the error,
but this is not valid, since in the case of such invalid usage the
internal state of the cond variable has already been potentially
corrupted (due to access outside the control of the mutex). thus, we
have to check first.

diff --git a/src/thread/pthread_cond_timedwait.c b/src/thread/pthread_cond_timedwait.c
index db2744bad7b7c36c4f7cf7b0ac47a8f49222316b..faa7c23b657ca3739eaf22d0d6651f9cc1985ce8 100644 (file)
--- a/src/thread/pthread_cond_timedwait.c
+++ b/src/thread/pthread_cond_timedwait.c
@@ -37,6 +37,9 @@ int pthread_cond_timedwait(pthread_cond_t *c, pthread_mutex_t *m, const struct t
        struct cm cm = { .c=c, .m=m };
        int r, e=0, seq;
 
+       if ((m->_m_type&3) == PTHREAD_MUTEX_ERRORCHECK &&
+               (m->_m_lock&INT_MAX) != __pthread_self()->tid) return EPERM;
+
        if (ts && ts->tv_nsec >= 1000000000UL)
                return EINVAL;