AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-12-25 04:01:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

nptl: Fix invalid Systemtap probe in pthread_join [BZ #24211]

Browse Source 
After commit f1ac745583 ("arm: Use "nr"
constraint for Systemtap probes [BZ #24164]"), we load pd->result into
a register in the probe below:

      /* Free the TCB.  */
      __free_tcb (pd);
    }
  else
    pd->joinid = NULL;

  LIBC_PROBE (pthread_join_ret, 3, threadid, result, pd->result);

However, at this point, the thread descriptor has been freed.  If the
thread stack does not fit into the thread stack cache, the memory will
have been unmapped, and the program will crash in the probe.
This commit is contained in:
Florian Weimer 2019-02-15 19:09:00 +01:00
parent 8a11f97062
commit bc10e22c90
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2019-02-15 Florian Weimer <fweimer@redhat.com>
[BZ #24211]
* nptl/pthread_join_common.c (__pthread_timedjoin_ex): Do not read
pd->result after the thread descriptor has been freed.
2019-02-15 Joseph Myers <joseph@codesourcery.com>
* sunrpc/tst-svc_register.c (rpcbind_address): Remove qualifier

5
nptl/pthread_join_common.c
View File

@ -145,6 +145,7 @@ __pthread_timedjoin_ex (pthread_t threadid, void **thread_return,
pthread_cleanup_pop (0);
}
void *pd_result = pd->result;
if (__glibc_likely (result == 0))
{
/* We mark the thread as terminated and as joined. */
@ -152,7 +153,7 @@ __pthread_timedjoin_ex (pthread_t threadid, void **thread_return,
/* Store the return value if the caller is interested. */
if (thread_return != NULL)
*thread_return = pd->result;
*thread_return = pd_result;
/* Free the TCB. */
__free_tcb (pd);
@ -160,7 +161,7 @@ __pthread_timedjoin_ex (pthread_t threadid, void **thread_return,
else
pd->joinid = NULL;
LIBC_PROBE (pthread_join_ret, 3, threadid, result, pd->result);
LIBC_PROBE (pthread_join_ret, 3, threadid, result, pd_result);
return result;
}