fix potential unsynchronized access to killlock state at thread exit

[musl] / src / thread / pthread_create.c

diff --git a/src/thread/pthread_create.c b/src/thread/pthread_create.c
index 6bdfb44..087f620 100644 (file)
--- a/src/thread/pthread_create.c
+++ b/src/thread/pthread_create.c
@@ -69,15 +69,29 @@ _Noreturn void __pthread_exit(void *result)
 
        __pthread_tsd_run_dtors();
 
+       __block_app_sigs(&set);
+
+       /* This atomic potentially competes with a concurrent pthread_detach
+        * call; the loser is responsible for freeing thread resources. */
+       int state = a_cas(&self->detach_state, DT_JOINABLE, DT_EXITING);
+
+       if (state==DT_DETACHED && self->map_base) {
+               /* Since __unmapself bypasses the normal munmap code path,
+                * explicitly wait for vmlock holders first. This must be
+                * done before any locks are taken, to avoid lock ordering
+                * issues that could lead to deadlock. */
+               __vm_wait();
+       }
+
        /* Access to target the exiting thread with syscalls that use
         * its kernel tid is controlled by killlock. For detached threads,
         * any use past this point would have undefined behavior, but for
-        * joinable threads it's a valid usage that must be handled. */
+        * joinable threads it's a valid usage that must be handled.
+        * Signals must be blocked since pthread_kill must be AS-safe. */
        LOCK(self->killlock);
 
-       /* The thread list lock must be AS-safe, and thus requires
-        * application signals to be blocked before it can be taken. */
-       __block_app_sigs(&set);
+       /* The thread list lock must be AS-safe, and thus depends on
+        * application signals being blocked above. */
        __tl_lock();
 
        /* If this is the only thread in the list, don't proceed with
@@ -85,13 +99,24 @@ _Noreturn void __pthread_exit(void *result)
         * signal state to prepare for exit to call atexit handlers. */
        if (self->next == self) {
                __tl_unlock();
-               __restore_sigs(&set);
                UNLOCK(self->killlock);
+               self->detach_state = state;
+               __restore_sigs(&set);
                exit(0);
        }
 
        /* At this point we are committed to thread termination. */
 
+       /* After the kernel thread exits, its tid may be reused. Clear it
+        * to prevent inadvertent use and inform functions that would use
+        * it that it's no longer available. At this point the killlock
+        * may be released, since functions that use it will consistently
+        * see the thread as having exited. Release it now so that no
+        * remaining locks (except thread list) are held if we end up
+        * resetting need_locks below. */
+       self->tid = 0;
+       UNLOCK(self->killlock);
+
        /* Process robust list in userspace to handle non-pshared mutexes
         * and the detached thread case where the robust list head will
         * be invalid when the kernel would process it. */
@@ -124,10 +149,6 @@ _Noreturn void __pthread_exit(void *result)
        self->prev->next = self->next;
        self->prev = self->next = self;
 
-       /* This atomic potentially competes with a concurrent pthread_detach
-        * call; the loser is responsible for freeing thread resources. */
-       int state = a_cas(&self->detach_state, DT_JOINABLE, DT_EXITING);
-
        if (state==DT_DETACHED && self->map_base) {
                /* Detached threads must block even implementation-internal
                 * signals, since they will not have a stack in their last
@@ -139,24 +160,15 @@ _Noreturn void __pthread_exit(void *result)
                if (self->robust_list.off)
                        __syscall(SYS_set_robust_list, 0, 3*sizeof(long));
 
-               /* Since __unmapself bypasses the normal munmap code path,
-                * explicitly wait for vmlock holders first. */
-               __vm_wait();
-
                /* The following call unmaps the thread's stack mapping
                 * and then exits without touching the stack. */
                __unmapself(self->map_base, self->map_size);
        }
 
        /* Wake any joiner. */
+       a_store(&self->detach_state, DT_EXITED);
        __wake(&self->detach_state, 1, 1);
 
-       /* After the kernel thread exits, its tid may be reused. Clear it
-        * to prevent inadvertent use and inform functions that would use
-        * it that it's no longer available. */
-       self->tid = 0;
-       UNLOCK(self->killlock);
-
        for (;;) __syscall(SYS_exit, 0);
 }
 
@@ -313,7 +325,7 @@ int __pthread_create(pthread_t *restrict res, const pthread_attr_t *restrict att
                new->detach_state = DT_JOINABLE;
        }
        new->robust_list.head = &new->robust_list.head;
-       new->CANARY = self->CANARY;
+       new->canary = self->canary;
        new->sysinfo = self->sysinfo;
 
        /* Setup argument structure for the new thread on its stack.