mirror of git://sourceware.org/git/glibc.git
5da15b15ad
The use-after-free described in BZ#19951 is due to the use of two
different PD fields, 'joinid' and 'cancelhandling', to describe the
thread state and to synchronise the calls of pthread_join,
pthread_detach, pthread_exit, and normal thread exit.
Any state change may require checking both fields atomically to handle
partial state (e.g., pthread_join() with a cancellation handler to
issue a 'joinstate' field rollback).
This patch uses a different PD member with 4 possible states (JOINABLE,
DETACHED, EXITING, and EXITED) instead of the pthread 'tid' field, with
the following logic:
1. On pthread_create, the initial state is set either to JOINABLE or
DETACHED depending on the pthread attribute used.
2. On pthread_detach, a CAS is issued on the state. If the CAS fails,
the thread is already detached (DETACHED) or being terminated (EXITING).
For the former, an EINVAL is returned; for the latter, pthread_detach
should be responsible for joining the thread (and for deallocating any
internal resources).
3. In the exit phase of the wrapper function for the thread start routine
(reached either if the thread function has returned, pthread_exit has
been called, or cancellation handled has been acted upon), we issue a
CAS on state to set it to the EXITING mode.
If the thread is previously in DETACHED mode, the thread is responsible
for deallocating any resources; otherwise, the thread must be joined
(detached threads cannot deallocate themselves immediately).
4. The clear_tid_field on 'clone' call is changed to set the new 'state'
field on thread exit (EXITED). This state is only reached at thread
termination.
5. The pthread_join implementation is now simpler: the futex wait is done
directly on thread state, and there is no need to reset it in case of
timeout since the state is now set either by pthread_detach() or by the
kernel on process termination.
The race condition on pthread_detach is avoided with a single atomic
operation on the PD state: once the mode is set to THREAD_STATE_DETACHED, it
is up to the thread itself to deallocate its memory (done during the exit
phase at pthread_create()).
Also, the INVALID_NOT_TERMINATED_TD_P is removed since a negative yid is
not possible, and the macro is not used anywhere.
This change triggers an invalid C11 thread test: it creates a thread that
detaches, and after a timeout, the creating thread checks whether the join
fails. The issue is that once thrd_join() is called, the thread's lifetime
is not defined.
Checked on x86_64-linux-gnu, i686-linux-gnu, aarch64-linux-gnu,
arm-linux-gnueabihf, and powerpc64-linux-gnu.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
|
||
|---|---|---|
| .. | ||
| bits | ||
| sys | ||
| Implies | ||
| Makeconfig | ||
| Makefile | ||
| Subdirs | ||
| _Fork.c | ||
| aio_misc.h | ||
| c11-thread.h | ||
| cancellation-pc-check.h | ||
| dl-mutex.c | ||
| dl-thread_gscope_wait.c | ||
| dl-tls_init_tp.c | ||
| dl-tunables.list | ||
| fork.h | ||
| futex-internal.h | ||
| gai_misc.h | ||
| internaltypes.h | ||
| jmp-unwind.c | ||
| libc-lock.h | ||
| libc-lockP.h | ||
| libc_start_call_main.h | ||
| lowlevellock-futex.h | ||
| lowlevellock.h | ||
| malloc-machine.h | ||
| proc_service.h | ||
| pthread-offsets.h | ||
| pthread.h | ||
| pthreadP.h | ||
| pthread_atfork_compat.h | ||
| pthread_early_init.h | ||
| pthread_mutex_backoff.h | ||
| pthread_mutex_conf.h | ||
| rseq-access.h | ||
| setxid.h | ||
| stdio-lock.h | ||
| tcb-access.h | ||
| tcb-offsets.h | ||
| thread_db.h | ||
| timer_routines.h | ||
| tst-mqueue8x.c | ||