diff options
| author | Samuel Thibault <samuel.thibault@ens-lyon.org> | 2022-01-15 21:30:17 +0100 |
|---|---|---|
| committer | Samuel Thibault <samuel.thibault@ens-lyon.org> | 2022-01-15 21:31:08 +0100 |
| commit | c1105e34aced53b26f02176b973079eb30fc54b1 (patch) | |
| tree | 3875e9daac97d62f1fa1edd2d1f3714f94215ef4 | |
| parent | 630d2568a1dfa1912458396e0522f67eef215f7d (diff) | |
| download | glibc-c1105e34aced53b26f02176b973079eb30fc54b1.tar.gz glibc-c1105e34aced53b26f02176b973079eb30fc54b1.tar.xz glibc-c1105e34aced53b26f02176b973079eb30fc54b1.zip | |
htl: Clear kernel_thread field before releasing the thread structure
Otherwise this is a use-after-free.
| -rw-r--r-- | sysdeps/mach/htl/pt-thread-terminate.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sysdeps/mach/htl/pt-thread-terminate.c b/sysdeps/mach/htl/pt-thread-terminate.c index 0cf72b330f..9bd6c3434d 100644 --- a/sysdeps/mach/htl/pt-thread-terminate.c +++ b/sysdeps/mach/htl/pt-thread-terminate.c @@ -62,15 +62,15 @@ __pthread_thread_terminate (struct __pthread *thread) ? __mig_get_reply_port () : MACH_PORT_NULL; __mach_port_deallocate (__mach_task_self (), self_ktid); + /* The kernel thread won't be there any more. */ + thread->kernel_thread = MACH_PORT_DEAD; + /* Finally done with the thread structure. */ __pthread_dealloc (thread); /* The wake up port is now no longer needed. */ __mach_port_destroy (__mach_task_self (), wakeup_port); - /* The kernel thread won't be there any more. */ - thread->kernel_thread = MACH_PORT_DEAD; - /* Terminate and release all that's left. */ err = __thread_terminate_release (kernel_thread, mach_task_self (), kernel_thread, reply_port, |