[Bug nptl/12889] New: Race condition in pthread_kill

["bugdal at aerifal dot cx" <sourceware-bugzilla@sourceware.org>]

http://sourceware.org/bugzilla/show_bug.cgi?id=12889

           Summary: Race condition in pthread_kill
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nptl
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: bugdal@aerifal.cx


There is a race condition in pthread_kill: it is possible that, between the
time pthread_kill reads the pid/tid from the target thread descriptor and the
time it makes the tgkill syscall, the target thread terminates and the same tid
gets assigned to a new thread in the same process.

(The tgkill syscall was designed to eliminate a similar race condition in
tkill, but it only succeeded in eliminating races where the tid gets reused in
a different process, and does not help if the same tid gets assigned to a new
thread in the same process.)

The only solution I can see is to introduce a mutex that ensures that a thread
cannot exit while pthread_kill is being called on it.

Note that in most real-world situations, like almost all race conditions, this
one will be extremely rare. To make it measurable, one could exhaust all but
1-2 available pid values, possibly by lowering the max pid parameter in /proc,
forcing the same tid to be reused rapidly.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.