about summary refs log tree commit diff
diff options
context:
space:
mode:
authorAndreas Schwab <schwab@suse.de>2020-05-07 15:50:09 +0200
committerAndreas Schwab <schwab@suse.de>2020-05-12 17:17:49 +0200
commit4cab20fa49b3ea3e3454fdc4f13bf3828d8efd19 (patch)
tree4d9e5f35863adc7468002bc246b2c4dbd0abfcd3
parent16536e98e36e08bc1ce1edbd8dd50c7c3bb7a936 (diff)
downloadglibc-4cab20fa49b3ea3e3454fdc4f13bf3828d8efd19.tar.gz
glibc-4cab20fa49b3ea3e3454fdc4f13bf3828d8efd19.tar.xz
glibc-4cab20fa49b3ea3e3454fdc4f13bf3828d8efd19.zip
nptl: wait for pending setxid request also in detached thread (bug 25942)
There is a race between __nptl_setxid and exiting detached thread, which
causes a deadlock on stack_cache_lock.  The deadlock happens in this
state:

T1: setgroups -> __nptl_setxid (holding stack_cache_lock, waiting on cmdp->cntr == 0)
T2 (detached, exiting): start_thread -> __deallocate_stack (waiting on stack_cache_lock)
more threads waiting on stack_cache_lock in pthread_create

For non-detached threads, start_thread waits for its own setxid handler to
finish before exiting.  Do this for detached threads as well.
-rw-r--r--nptl/pthread_create.c11
1 files changed, 6 insertions, 5 deletions
diff --git a/nptl/pthread_create.c b/nptl/pthread_create.c
index afd379e89a..a43089065c 100644
--- a/nptl/pthread_create.c
+++ b/nptl/pthread_create.c
@@ -552,11 +552,7 @@ START_THREAD_DEFN
   advise_stack_range (pd->stackblock, pd->stackblock_size, (uintptr_t) pd,
 		      pd->guardsize);
 
-  /* If the thread is detached free the TCB.  */
-  if (IS_DETACHED (pd))
-    /* Free the TCB.  */
-    __free_tcb (pd);
-  else if (__glibc_unlikely (pd->cancelhandling & SETXID_BITMASK))
+  if (__glibc_unlikely (pd->cancelhandling & SETXID_BITMASK))
     {
       /* Some other thread might call any of the setXid functions and expect
 	 us to reply.  In this case wait until we did that.  */
@@ -572,6 +568,11 @@ START_THREAD_DEFN
       pd->setxid_futex = 0;
     }
 
+  /* If the thread is detached free the TCB.  */
+  if (IS_DETACHED (pd))
+    /* Free the TCB.  */
+    __free_tcb (pd);
+
   /* We cannot call '_exit' here.  '_exit' will terminate the process.
 
      The 'exit' implementation in the kernel will signal when the