[Bug libc/10643] New: If pthread_create fails in aio_write, requests linked list is corrupted

[Bug libc/10643] New: If pthread_create fails in aio_write, requests linked list is corrupted

[nvachhar at google dot com]

When one calls aio_write, it internally calls __aio_enqueue_request, which will 
in turn call aio_create_helper_thread.  If thread creation fails, the newly 
created request (newp in the code) will still be in the requests linked list, but 
it will be freed later in __aio_enqueue_request.  A subsequent call to aio_write 
will cause a segmentation fault.

This bug was found in glibc-2.3.6, however a manual inspection of the code in git 
reveals that the problem still exists.

-- 
           Summary: If pthread_create fails in aio_write, requests linked
                    list is corrupted
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: nvachhar at google dot com
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: i686/x86_64-unknown-linux-gnu
  GCC host triplet: i686/x86_64-unknown-linux-gnu
GCC target triplet: i686/x86_64-unknown-linux-gnu


http://sourceware.org/bugzilla/show_bug.cgi?id=10643

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10643] If pthread_create fails in aio_write, requests linked list is corrupted

[nvachhar at google dot com]

------- Additional Comments From nvachhar at google dot com  2009-09-15 21:41 -------
Created an attachment (id=4198)
 --> (http://sourceware.org/bugzilla/attachment.cgi?id=4198&action=view)
Test case

If this is compiled with -DCRASH, then the program will segfault.  Otherwise,
it will work properly.

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=10643

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10643] If pthread_create fails in aio_write, requests linked list is corrupted

[ppluzhnikov at google dot com]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ppluzhnikov at google dot
                   |                            |com


http://sourceware.org/bugzilla/show_bug.cgi?id=10643

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10643] If pthread_create fails in aio_write, requests linked list is corrupted

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2009-10-30 04:02 -------
There were a number of problems in that area.  I think I fixed them in git.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://sourceware.org/bugzilla/show_bug.cgi?id=10643

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10643] If pthread_create fails in aio_write, requests linked list is corrupted

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=10643

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.