From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 8292 invoked by alias); 15 Jun 2011 00:39:50 -0000 Received: (qmail 8278 invoked by uid 22791); 15 Jun 2011 00:39:49 -0000 X-SWARE-Spam-Status: No, hits=-2.8 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00,TW_TG X-Spam-Check-By: sourceware.org Received: from localhost (HELO sourceware.org) (127.0.0.1) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Wed, 15 Jun 2011 00:39:34 +0000 From: "bugdal at aerifal dot cx" To: glibc-bugs@sources.redhat.com Subject: [Bug nptl/12889] New: Race condition in pthread_kill X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: glibc X-Bugzilla-Component: nptl X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: bugdal at aerifal dot cx X-Bugzilla-Status: NEW X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: drepper.fsp at gmail dot com X-Bugzilla-Target-Milestone: --- X-Bugzilla-Changed-Fields: Message-ID: X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated Content-Type: text/plain; charset="UTF-8" MIME-Version: 1.0 Date: Wed, 15 Jun 2011 00:39:00 -0000 Mailing-List: contact glibc-bugs-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Post: List-Help: , Sender: glibc-bugs-owner@sourceware.org X-SW-Source: 2011-06/txt/msg00045.txt.bz2 http://sourceware.org/bugzilla/show_bug.cgi?id=12889 Summary: Race condition in pthread_kill Product: glibc Version: unspecified Status: NEW Severity: normal Priority: P2 Component: nptl AssignedTo: drepper.fsp@gmail.com ReportedBy: bugdal@aerifal.cx There is a race condition in pthread_kill: it is possible that, between the time pthread_kill reads the pid/tid from the target thread descriptor and the time it makes the tgkill syscall, the target thread terminates and the same tid gets assigned to a new thread in the same process. (The tgkill syscall was designed to eliminate a similar race condition in tkill, but it only succeeded in eliminating races where the tid gets reused in a different process, and does not help if the same tid gets assigned to a new thread in the same process.) The only solution I can see is to introduce a mutex that ensures that a thread cannot exit while pthread_kill is being called on it. Note that in most real-world situations, like almost all race conditions, this one will be extremely rare. To make it measurable, one could exhaust all but 1-2 available pid values, possibly by lowering the max pid parameter in /proc, forcing the same tid to be reused rapidly. -- Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.