public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug nptl/3270] New: Setuid implementation has races and lockups
@ 2006-09-27 15:37 drow at sources dot redhat dot com
  2006-09-27 15:38 ` [Bug nptl/3270] " drow at sources dot redhat dot com
                   ` (8 more replies)
  0 siblings, 9 replies; 12+ messages in thread
From: drow at sources dot redhat dot com @ 2006-09-27 15:37 UTC (permalink / raw)
  To: glibc-bugs

I discovered a problem with the existing code for __nptl_setxid.  It can set the
setxid bit in cancelhandling for a thread, and then fail to send it a signal,
leading to a lockup in start_thread during thread exit.  This can happen when
the thread's stack has been allocated (under stack_cache_lock) but the thread
has not yet been created, so TID is not set in the thread descriptor.

Similarly, __nptl_setxid can miss a thread being created just before its parent
is signalled, leaving that thread with the wrong UID.  There were also minor
problems, e.g. setxid_futex was never reset so the exit behavior was different
if the thread had experienced at least one prior setxid event during its lifetime.

I'll attach a patch and testcase.

-- 
           Summary: Setuid implementation has races and lockups
           Product: glibc
           Version: 2.4
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nptl
        AssignedTo: drepper at redhat dot com
        ReportedBy: drow at sources dot redhat dot com
                CC: glibc-bugs at sources dot redhat dot com
  GCC host triplet: x86_64-pc-linux-gnu


http://sourceware.org/bugzilla/show_bug.cgi?id=3270

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.


^ permalink raw reply	[flat|nested] 12+ messages in thread
[parent not found: <bug-3270-131@http.sourceware.org/bugzilla/>]
end of thread, other threads:[~2014-07-01 20:28 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2006-09-27 15:37 [Bug nptl/3270] New: Setuid implementation has races and lockups drow at sources dot redhat dot com
2006-09-27 15:38 ` [Bug nptl/3270] " drow at sources dot redhat dot com
2006-09-27 15:41 ` drow at sources dot redhat dot com
2007-12-15  9:48 ` ismail at pardus dot org dot tr
2008-02-12 22:34 ` pwatkins at sicortex dot com
2008-12-05 14:22 ` vincent dot arrat at infotel dot com
2008-12-05 16:01 ` pasky at suse dot cz
2009-10-29 16:54 ` schwab at linux-m68k dot org
2009-10-29 16:55 ` schwab at linux-m68k dot org
2009-10-30  8:01 ` drepper at redhat dot com
     [not found] <bug-3270-131@http.sourceware.org/bugzilla/>
2014-04-15 23:01 ` wade.colson at aol dot com
2014-07-01 20:28 ` fweimer at redhat dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).