From f8bf15febcaf137bbec5a61101e88cd5a9d56ca8 Mon Sep 17 00:00:00 2001 From: Carlos O'Donell Date: Sat, 28 Jan 2017 19:13:34 -0500 Subject: Bug 20116: Fix use after free in pthread_create() The commit documents the ownership rules around 'struct pthread' and when a thread can read or write to the descriptor. With those ownership rules in place it becomes obvious that pd->stopped_start should not be touched in several of the paths during thread startup, particularly so for detached threads. In the case of detached threads, between the time the thread is created by the OS kernel and the creating thread checks pd->stopped_start, the detached thread might have already exited and the memory for pd unmapped. As a regression test we add a simple test which exercises this exact case by quickly creating detached threads with large enough stacks to ensure the thread stack cache is bypassed and the stacks are unmapped. Before the fix the testcase segfaults, after the fix it works correctly and completes without issue. For a detailed discussion see: https://www.sourceware.org/ml/libc-alpha/2017-01/msg00505.html --- nptl/tpp.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'nptl/tpp.c') diff --git a/nptl/tpp.c b/nptl/tpp.c index f2e6905..57eb026 100644 --- a/nptl/tpp.c +++ b/nptl/tpp.c @@ -114,6 +114,7 @@ __pthread_tpp_change_priority (int previous_prio, int new_prio) if (priomax == newpriomax) return 0; + /* See CREATE THREAD NOTES in nptl/pthread_create.c. */ lll_lock (self->lock, LLL_PRIVATE); tpp->priomax = newpriomax; @@ -165,6 +166,7 @@ __pthread_current_priority (void) int result = 0; + /* See CREATE THREAD NOTES in nptl/pthread_create.c. */ lll_lock (self->lock, LLL_PRIVATE); if ((self->flags & ATTR_FLAG_SCHED_SET) == 0) -- cgit v1.1