aboutsummaryrefslogtreecommitdiff
path: root/nptl
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2020-05-15 21:24:59 +0200
committerFlorian Weimer <fweimer@redhat.com>2020-05-20 20:29:10 +0200
commitcea81e2b7e441663539d196c18bb2568e3e2fae8 (patch)
tree6da96a605219ff90e7026b36a7c87acaef63492a /nptl
parent331c6e8a184167dd21a9f0b3fc165aeefea6eeca (diff)
downloadglibc-cea81e2b7e441663539d196c18bb2568e3e2fae8.zip
glibc-cea81e2b7e441663539d196c18bb2568e3e2fae8.tar.gz
glibc-cea81e2b7e441663539d196c18bb2568e3e2fae8.tar.bz2
nptl: Use __pthread_attr_copy in pthread_getattr_default_np (bug 25999)
pthread_getattr_default_np needs to make a deep copy. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
Diffstat (limited to 'nptl')
-rw-r--r--nptl/Makefile1
-rw-r--r--nptl/pthread_getattr_default_np.c12
-rw-r--r--nptl/tst-pthread-defaultattr-free.c78
3 files changed, 82 insertions, 9 deletions
diff --git a/nptl/Makefile b/nptl/Makefile
index b4aaad0..e5686b2 100644
--- a/nptl/Makefile
+++ b/nptl/Makefile
@@ -328,6 +328,7 @@ tests = tst-attr2 tst-attr3 tst-default-attr \
tst-thread-affinity-pthread \
tst-thread-affinity-pthread2 \
tst-thread-affinity-sched \
+ tst-pthread-defaultattr-free \
tests-container = tst-pthread-getattr
diff --git a/nptl/pthread_getattr_default_np.c b/nptl/pthread_getattr_default_np.c
index cce20cb..a9665c5 100644
--- a/nptl/pthread_getattr_default_np.c
+++ b/nptl/pthread_getattr_default_np.c
@@ -16,20 +16,14 @@
License along with the GNU C Library; if not, see
<https://www.gnu.org/licenses/>. */
-#include <errno.h>
-#include <stdlib.h>
#include <pthreadP.h>
int
pthread_getattr_default_np (pthread_attr_t *out)
{
- struct pthread_attr *real_out;
-
- real_out = (struct pthread_attr *) out;
-
lll_lock (__default_pthread_attr_lock, LLL_PRIVATE);
- *real_out = __default_pthread_attr;
+ int ret = __pthread_attr_copy (out,
+ (pthread_attr_t *) &__default_pthread_attr);
lll_unlock (__default_pthread_attr_lock, LLL_PRIVATE);
-
- return 0;
+ return ret;
}
diff --git a/nptl/tst-pthread-defaultattr-free.c b/nptl/tst-pthread-defaultattr-free.c
new file mode 100644
index 0000000..5a84302
--- /dev/null
+++ b/nptl/tst-pthread-defaultattr-free.c
@@ -0,0 +1,78 @@
+/* Test for user-after-free bug in pthread_getattr_default_np (bug 25999).
+ Copyright (C) 2020 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <https://www.gnu.org/licenses/>. */
+
+#include <pthread.h>
+#include <sched.h>
+#include <support/check.h>
+#include <support/xthread.h>
+
+static int
+do_test (void)
+{
+ /* This is a typical affinity size. */
+ enum { cpu_count = 128 };
+ cpu_set_t *set = CPU_ALLOC (cpu_count);
+ size_t set_size = CPU_ALLOC_SIZE (cpu_count);
+ CPU_ZERO_S (set_size, set);
+ CPU_SET (1, set);
+ CPU_SET (3, set);
+
+ /* Apply the affinity mask to the default attribute. */
+ pthread_attr_t attr;
+ xpthread_attr_init (&attr);
+ TEST_COMPARE (pthread_attr_setaffinity_np (&attr, set_size, set), 0);
+ TEST_COMPARE (pthread_setattr_default_np (&attr), 0);
+ xpthread_attr_destroy (&attr);
+
+ /* Read back the default attribute and check affinity mask. */
+ pthread_getattr_default_np (&attr);
+ CPU_ZERO_S (set_size, set);
+ TEST_COMPARE (pthread_attr_getaffinity_np (&attr, set_size, set), 0);
+ for (int i = 0; i < cpu_count; ++i)
+ TEST_COMPARE (!!CPU_ISSET (i, set), i == 1 || i == 3);
+
+
+ /* Apply a larger CPU affinity mask to the default attribute, to
+ trigger reallocation. */
+ {
+ cpu_set_t *large_set = CPU_ALLOC (4 * cpu_count);
+ size_t large_set_size = CPU_ALLOC_SIZE (4 * cpu_count);
+ CPU_ZERO_S (large_set_size, large_set);
+ pthread_attr_t large_attr;
+ xpthread_attr_init (&large_attr);
+ TEST_COMPARE (pthread_attr_setaffinity_np (&large_attr,
+ large_set_size, large_set), 0);
+ TEST_COMPARE (pthread_setattr_default_np (&large_attr), 0);
+ xpthread_attr_destroy (&large_attr);
+ CPU_FREE (large_set);
+ }
+
+ /* Read back the default attribute and check affinity mask. */
+ CPU_ZERO_S (set_size, set);
+ TEST_COMPARE (pthread_attr_getaffinity_np (&attr, set_size, set), 0);
+ for (int i = 0; i < cpu_count; ++i)
+ TEST_COMPARE (!!CPU_ISSET (i, set), i == 1 || i == 3);
+ /* Due to bug 25999, the following caused a double-free abort. */
+ xpthread_attr_destroy (&attr);
+
+ CPU_FREE (set);
+
+ return 0;
+}
+
+#include <support/test-driver.c>