about summary refs log tree commit diff
path: root/nptl
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2019-02-15 19:09:00 +0100
committerFlorian Weimer <fweimer@redhat.com>2019-02-15 19:09:00 +0100
commitbc10e22c90e42613bd5dafb77b80a9ea1759dd1b (patch)
tree6a4ad2ab7ea72292e1733e7a4ef7f70eb4fc8c09 /nptl
parent8a11f97062ec7f1a2fed4aefa36c7bebecf87181 (diff)
downloadglibc-bc10e22c90e42613bd5dafb77b80a9ea1759dd1b.tar.gz
glibc-bc10e22c90e42613bd5dafb77b80a9ea1759dd1b.tar.xz
glibc-bc10e22c90e42613bd5dafb77b80a9ea1759dd1b.zip
nptl: Fix invalid Systemtap probe in pthread_join [BZ #24211]
After commit f1ac7455831546e5dca0ed98fe8af2686fae7ce6 ("arm: Use "nr"
constraint for Systemtap probes [BZ #24164]"), we load pd->result into
a register in the probe below:

      /* Free the TCB.  */
      __free_tcb (pd);
    }
  else
    pd->joinid = NULL;

  LIBC_PROBE (pthread_join_ret, 3, threadid, result, pd->result);

However, at this point, the thread descriptor has been freed.  If the
thread stack does not fit into the thread stack cache, the memory will
have been unmapped, and the program will crash in the probe.
Diffstat (limited to 'nptl')
-rw-r--r--nptl/pthread_join_common.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/nptl/pthread_join_common.c b/nptl/pthread_join_common.c
index 6efe8efc3f..5224ee2110 100644
--- a/nptl/pthread_join_common.c
+++ b/nptl/pthread_join_common.c
@@ -145,6 +145,7 @@ __pthread_timedjoin_ex (pthread_t threadid, void **thread_return,
       pthread_cleanup_pop (0);
     }
 
+  void *pd_result = pd->result;
   if (__glibc_likely (result == 0))
     {
       /* We mark the thread as terminated and as joined.  */
@@ -152,7 +153,7 @@ __pthread_timedjoin_ex (pthread_t threadid, void **thread_return,
 
       /* Store the return value if the caller is interested.  */
       if (thread_return != NULL)
-	*thread_return = pd->result;
+	*thread_return = pd_result;
 
       /* Free the TCB.  */
       __free_tcb (pd);
@@ -160,7 +161,7 @@ __pthread_timedjoin_ex (pthread_t threadid, void **thread_return,
   else
     pd->joinid = NULL;
 
-  LIBC_PROBE (pthread_join_ret, 3, threadid, result, pd->result);
+  LIBC_PROBE (pthread_join_ret, 3, threadid, result, pd_result);
 
   return result;
 }