This is the mail archive of the
glibc-bugs@sourceware.org
mailing list for the glibc project.
[Bug nptl/2644] New: Race condition during unwind code after thread cancellation
- From: "batneil at thebatcave dot org dot uk" <sourceware-bugzilla at sourceware dot org>
- To: glibc-bugs at sources dot redhat dot com
- Date: 7 May 2006 13:56:30 -0000
- Subject: [Bug nptl/2644] New: Race condition during unwind code after thread cancellation
- Reply-to: sourceware-bugzilla at sourceware dot org
I think there is a race condition in the code in
nptl/sysdeps/pthread/unwind-forcedunwind.c which can lead to a segfault. I
found this in a redhat build, but it exists in CVS glibc too (as of May 6 2006).
Consider a call to _Unwind_ForcedUnwind, when libgcc_s_forcedunwind has not been
loaded. _Unwind_ForcedUnwind checks the value against null, and jumps to
pthread_cancel_init. Meanwhile another thread comes in and initialises all
these pointers, so the first check in pthread_cancel_init shows that
libgcc_s_getcfa is non-null, so we return to _Unwind_ForcedUnwind and execute
libgcc_s_forcedunwind. As the function pointer libgcc_s_forcedunwind has not
been marked volatile, the compiler does not need to reload this value, and
attempts to call the address it previously loaded, ie. 0.
I have a test case which shows the problem and patch which I believe fixes it.
--
Summary: Race condition during unwind code after thread
cancellation
Product: glibc
Version: unspecified
Status: NEW
Severity: normal
Priority: P2
Component: nptl
AssignedTo: drepper at redhat dot com
ReportedBy: batneil at thebatcave dot org dot uk
CC: glibc-bugs at sources dot redhat dot com
GCC build triplet: i686-redhat-linux
GCC host triplet: i686-redhat-linux
GCC target triplet: i686-redhat-linux
http://sourceware.org/bugzilla/show_bug.cgi?id=2644
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.