fix stack protector crashes on x32 & powerpc due to misplaced TLS canary

[musl] / src / thread / pthread_create.c

diff --git a/src/thread/pthread_create.c b/src/thread/pthread_create.c
index 8b0135b..4eb8b88 100644 (file)
--- a/src/thread/pthread_create.c
+++ b/src/thread/pthread_create.c
@@ -9,8 +9,6 @@
 void *__mmap(void *, size_t, int, int, int, off_t);
 int __munmap(void *, size_t);
 int __mprotect(void *, size_t, int);
-void __vm_lock_impl(int);
-void __vm_unlock_impl(void);
 
 static void dummy_0()
 {
@@ -19,6 +17,7 @@ weak_alias(dummy_0, __acquire_ptc);
 weak_alias(dummy_0, __release_ptc);
 weak_alias(dummy_0, __pthread_tsd_run_dtors);
 weak_alias(dummy_0, __do_orphaned_stdio_locks);
+weak_alias(dummy_0, __dl_thread_cleanup);
 
 _Noreturn void __pthread_exit(void *result)
 {
@@ -77,7 +76,7 @@ _Noreturn void __pthread_exit(void *result)
        /* Process robust list in userspace to handle non-pshared mutexes
         * and the detached thread case where the robust list head will
         * be invalid when the kernel would process it. */
-       __vm_lock_impl(+1);
+       __vm_lock();
        volatile void *volatile *rp;
        while ((rp=self->robust_list.head) && rp != &self->robust_list.head) {
                pthread_mutex_t *m = (void *)((char *)rp
@@ -91,9 +90,10 @@ _Noreturn void __pthread_exit(void *result)
                if (cont < 0 || waiters)
                        __wake(&m->_m_lock, 1, priv);
        }
-       __vm_unlock_impl();
+       __vm_unlock();
 
        __do_orphaned_stdio_locks();
+       __dl_thread_cleanup();
 
        if (self->detached && self->map_base) {
                /* Detached threads must avoid the kernel clear_child_tid
@@ -110,6 +110,10 @@ _Noreturn void __pthread_exit(void *result)
                if (self->robust_list.off)
                        __syscall(SYS_set_robust_list, 0, 3*sizeof(long));
 
+               /* Since __unmapself bypasses the normal munmap code path,
+                * explicitly wait for vmlock holders first. */
+               __vm_wait();
+
                /* The following call unmaps the thread's stack mapping
                 * and then exits without touching the stack. */
                __unmapself(self->map_base, self->map_size);
@@ -120,7 +124,6 @@ _Noreturn void __pthread_exit(void *result)
 
 void __do_cleanup_push(struct __ptcb *cb)
 {
-       if (!libc.has_thread_pointer) return;
        struct pthread *self = __pthread_self();
        cb->__next = self->cancelbuf;
        self->cancelbuf = cb;
@@ -128,7 +131,6 @@ void __do_cleanup_push(struct __ptcb *cb)
 
 void __do_cleanup_pop(struct __ptcb *cb)
 {
-       if (!libc.has_thread_pointer) return;
        __pthread_self()->cancelbuf = cb->__next;
 }
 
@@ -270,7 +272,7 @@ int __pthread_create(pthread_t *restrict res, const pthread_attr_t *restrict att
        }
        new->robust_list.head = &new->robust_list.head;
        new->unblock_cancel = self->cancel;
-       new->canary = self->canary;
+       new->CANARY = self->CANARY;
 
        a_inc(&libc.threads_minus_1);
        ret = __clone((c11 ? start_c11 : start), stack, flags, new, &new->tid, TP_ADJ(new), &new->tid);