aboutsummaryrefslogtreecommitdiff
path: root/support/Makefile
diff options
context:
space:
mode:
authorCarlos O'Donell <carlos@redhat.com>2017-01-28 19:13:34 -0500
committerCarlos O'Donell <carlos@redhat.com>2017-01-28 19:21:44 -0500
commitf8bf15febcaf137bbec5a61101e88cd5a9d56ca8 (patch)
tree77e4625039c3eb70b5dad4e1a1dcbb30517f3e60 /support/Makefile
parentfaf0e9c84119742dd9ebb79060faa22c52ae80a1 (diff)
downloadglibc-f8bf15febcaf137bbec5a61101e88cd5a9d56ca8.zip
glibc-f8bf15febcaf137bbec5a61101e88cd5a9d56ca8.tar.gz
glibc-f8bf15febcaf137bbec5a61101e88cd5a9d56ca8.tar.bz2
Bug 20116: Fix use after free in pthread_create()
The commit documents the ownership rules around 'struct pthread' and when a thread can read or write to the descriptor. With those ownership rules in place it becomes obvious that pd->stopped_start should not be touched in several of the paths during thread startup, particularly so for detached threads. In the case of detached threads, between the time the thread is created by the OS kernel and the creating thread checks pd->stopped_start, the detached thread might have already exited and the memory for pd unmapped. As a regression test we add a simple test which exercises this exact case by quickly creating detached threads with large enough stacks to ensure the thread stack cache is bypassed and the stacks are unmapped. Before the fix the testcase segfaults, after the fix it works correctly and completes without issue. For a detailed discussion see: https://www.sourceware.org/ml/libc-alpha/2017-01/msg00505.html
Diffstat (limited to 'support/Makefile')
-rw-r--r--support/Makefile4
1 files changed, 4 insertions, 0 deletions
diff --git a/support/Makefile b/support/Makefile
index 45aa7fc..2ace559 100644
--- a/support/Makefile
+++ b/support/Makefile
@@ -64,6 +64,10 @@ libsupport-routines = \
xmmap \
xmunmap \
xpoll \
+ xpthread_attr_destroy \
+ xpthread_attr_init \
+ xpthread_attr_setdetachstate \
+ xpthread_attr_setstacksize \
xpthread_barrier_destroy \
xpthread_barrier_init \
xpthread_barrier_wait \