aboutsummaryrefslogtreecommitdiff
path: root/nptl/tpp.c
diff options
context:
space:
mode:
authorCarlos O'Donell <carlos@redhat.com>2017-01-28 19:13:34 -0500
committerCarlos O'Donell <carlos@redhat.com>2017-01-28 19:21:44 -0500
commitf8bf15febcaf137bbec5a61101e88cd5a9d56ca8 (patch)
tree77e4625039c3eb70b5dad4e1a1dcbb30517f3e60 /nptl/tpp.c
parentfaf0e9c84119742dd9ebb79060faa22c52ae80a1 (diff)
downloadglibc-f8bf15febcaf137bbec5a61101e88cd5a9d56ca8.zip
glibc-f8bf15febcaf137bbec5a61101e88cd5a9d56ca8.tar.gz
glibc-f8bf15febcaf137bbec5a61101e88cd5a9d56ca8.tar.bz2
Bug 20116: Fix use after free in pthread_create()
The commit documents the ownership rules around 'struct pthread' and when a thread can read or write to the descriptor. With those ownership rules in place it becomes obvious that pd->stopped_start should not be touched in several of the paths during thread startup, particularly so for detached threads. In the case of detached threads, between the time the thread is created by the OS kernel and the creating thread checks pd->stopped_start, the detached thread might have already exited and the memory for pd unmapped. As a regression test we add a simple test which exercises this exact case by quickly creating detached threads with large enough stacks to ensure the thread stack cache is bypassed and the stacks are unmapped. Before the fix the testcase segfaults, after the fix it works correctly and completes without issue. For a detailed discussion see: https://www.sourceware.org/ml/libc-alpha/2017-01/msg00505.html
Diffstat (limited to 'nptl/tpp.c')
-rw-r--r--nptl/tpp.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/nptl/tpp.c b/nptl/tpp.c
index f2e6905..57eb026 100644
--- a/nptl/tpp.c
+++ b/nptl/tpp.c
@@ -114,6 +114,7 @@ __pthread_tpp_change_priority (int previous_prio, int new_prio)
if (priomax == newpriomax)
return 0;
+ /* See CREATE THREAD NOTES in nptl/pthread_create.c. */
lll_lock (self->lock, LLL_PRIVATE);
tpp->priomax = newpriomax;
@@ -165,6 +166,7 @@ __pthread_current_priority (void)
int result = 0;
+ /* See CREATE THREAD NOTES in nptl/pthread_create.c. */
lll_lock (self->lock, LLL_PRIVATE);
if ((self->flags & ATTR_FLAG_SCHED_SET) == 0)