From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 23995 invoked by alias); 28 Jun 2010 10:05:45 -0000 Received: (qmail 23979 invoked by uid 22791); 28 Jun 2010 10:05:45 -0000 X-SWARE-Spam-Status: No, hits=-4.8 required=5.0 tests=AWL,BAYES_20,RCVD_IN_DNSWL_HI,SPF_HELO_PASS,T_RP_MATCHES_RCVD X-Spam-Check-By: sourceware.org Received: from mx1.redhat.com (HELO mx1.redhat.com) (209.132.183.28) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Mon, 28 Jun 2010 10:05:38 +0000 Received: from int-mx08.intmail.prod.int.phx2.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o5SA5aSE010736 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 28 Jun 2010 06:05:37 -0400 Received: from hase.home (ovpn01.gateway.prod.ext.phx2.redhat.com [10.5.9.1]) by int-mx08.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id o5SA5ZRr009718 for ; Mon, 28 Jun 2010 06:05:36 -0400 From: Andreas Schwab To: libc-hacker@sourceware.org Subject: [PATCH] Fix setxid race handing exiting threads X-Yow: Put FIVE DOZEN red GIRDLES in each CIRCULAR OPENING!! Date: Mon, 28 Jun 2010 10:05:00 -0000 Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Mailing-List: contact libc-hacker-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-hacker-owner@sourceware.org X-SW-Source: 2010-06/txt/msg00007.txt.bz2 If two threads are calling setxid simultanously a race exists between releasing setxid_futex in sighandler_setxid and locking it again in setxid_mark_thread when the thread exited in the mean time. Make sure the exiting thread is eventually woken up. Andreas. 2010-06-28 Andreas Schwab * allocatestack.c (setxid_mark_thread): Ensure that the exiting thread is woken up. diff --git a/nptl/allocatestack.c b/nptl/allocatestack.c index 831e98e..1ce9ed5 100644 --- a/nptl/allocatestack.c +++ b/nptl/allocatestack.c @@ -994,7 +994,16 @@ setxid_mark_thread (struct xid_command *cmdp, struct pthread *t) /* If the thread is exiting right now, ignore it. */ if ((ch & EXITING_BITMASK) != 0) - return; + { + /* Release the futex if there is no other setxid in + progress. */ + if ((ch & SETXID_BITMASK) == 0) + { + t->setxid_futex = 1; + lll_futex_wake (&t->setxid_futex, 1, LLL_PRIVATE); + } + return; + } } while (atomic_compare_and_exchange_bool_acq (&t->cancelhandling, ch | SETXID_BITMASK, ch)); -- 1.7.1 -- Andreas Schwab, schwab@redhat.com GPG Key fingerprint = D4E8 DBE3 3813 BB5D FA84 5EC7 45C6 250E 6F00 984E "And now for something completely different."