From: Andreas Schwab <schwab@redhat.com>
To: libc-hacker@sourceware.org
Subject: [PATCH] Fix setxid race with thread creation
Date: Tue, 02 Mar 2010 15:55:00 -0000 [thread overview]
Message-ID: <m3tysyzpjn.fsf@hase.home> (raw)
When setxid runs in the time window between allocating a thread stack
and cloning the new thread this thread does not receive the setxid
signal and remains at the wrong xid.
Andreas.
2010-03-02 Andreas Schwab <schwab@redhat.com>
* allocatestack.c (get_cached_stack): Initialize setxid_futex to -1.
(allocate_stack): Likewise.
(setxid_mark_thread): Wait for setxid_futex != -1.
* sysdeps/pthread/createthread.c (do_clone): Set setxid_futex
after cloning.
diff --git a/nptl/allocatestack.c b/nptl/allocatestack.c
index 3c3585f..88f9574 100644
--- a/nptl/allocatestack.c
+++ b/nptl/allocatestack.c
@@ -213,6 +213,9 @@ get_cached_stack (size_t *sizep, void **memp)
return NULL;
}
+ /* Don't allow setxid until cloned. */
+ result->setxid_futex = -1;
+
/* Dequeue the entry. */
stack_list_del (&result->list);
@@ -418,6 +421,9 @@ allocate_stack (const struct pthread_attr *attr, struct pthread **pdp,
/* The process ID is also the same as that of the caller. */
pd->pid = THREAD_GETMEM (THREAD_SELF, pid);
+ /* Don't allow setxid until cloned. */
+ pd->setxid_futex = -1;
+
/* Allocate the DTV for this thread. */
if (_dl_allocate_tls (TLS_TPADJ (pd)) == NULL)
{
@@ -557,6 +563,9 @@ allocate_stack (const struct pthread_attr *attr, struct pthread **pdp,
/* The process ID is also the same as that of the caller. */
pd->pid = THREAD_GETMEM (THREAD_SELF, pid);
+ /* Don't allow setxid until cloned. */
+ pd->setxid_futex = -1;
+
/* Allocate the DTV for this thread. */
if (_dl_allocate_tls (TLS_TPADJ (pd)) == NULL)
{
@@ -969,6 +978,10 @@ setxid_mark_thread (struct xid_command *cmdp, struct pthread *t)
{
int ch;
+ /* Wait until this thread is cloned. */
+ while (t->setxid_futex == -1)
+ lll_futex_wait (&t->setxid_futex, -1, LLL_PRIVATE);
+
/* Don't let the thread exit before the setxid handler runs. */
t->setxid_futex = 0;
diff --git a/nptl/sysdeps/pthread/createthread.c b/nptl/sysdeps/pthread/createthread.c
index 66fafe8..d176bad 100644
--- a/nptl/sysdeps/pthread/createthread.c
+++ b/nptl/sysdeps/pthread/createthread.c
@@ -52,6 +52,8 @@ do_clone (struct pthread *pd, const struct pthread_attr *attr,
int clone_flags, int (*fct) (void *), STACK_VARIABLES_PARMS,
int stopped)
{
+ int rc;
+
#ifdef PREPARE_CREATE
PREPARE_CREATE;
#endif
@@ -72,8 +74,14 @@ do_clone (struct pthread *pd, const struct pthread_attr *attr,
that cares whether the thread count is correct. */
atomic_increment (&__nptl_nthreads);
- if (ARCH_CLONE (fct, STACK_VARIABLES_ARGS, clone_flags,
- pd, &pd->tid, TLS_VALUE, &pd->tid) == -1)
+ rc = ARCH_CLONE (fct, STACK_VARIABLES_ARGS, clone_flags,
+ pd, &pd->tid, TLS_VALUE, &pd->tid);
+
+ /* Allow setxid from now onwards. */
+ pd->setxid_futex = 0;
+ lll_futex_wake (&pd->setxid_futex, 1, LLL_PRIVATE);
+
+ if (rc == -1)
{
atomic_decrement (&__nptl_nthreads); /* Oops, we lied for a second. */
--
Andreas Schwab, schwab@redhat.com
GPG Key fingerprint = D4E8 DBE3 3813 BB5D FA84 5EC7 45C6 250E 6F00 984E
"And now for something completely different."
next reply other threads:[~2010-03-02 15:55 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-03-02 15:55 Andreas Schwab [this message]
2010-03-05 19:25 ` Ulrich Drepper
2010-03-08 13:57 ` Andreas Schwab
2010-03-09 6:06 ` Ulrich Drepper
2010-03-09 10:14 ` Andreas Schwab
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=m3tysyzpjn.fsf@hase.home \
--to=schwab@redhat.com \
--cc=libc-hacker@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).