fix pthread_detach inadvertently acting as cancellation point in race case

[musl] / src / thread / sem_open.c

diff --git a/src/thread/sem_open.c b/src/thread/sem_open.c
index ed2353c..0ad29de 100644 (file)
--- a/src/thread/sem_open.c
+++ b/src/thread/sem_open.c
@@ -11,16 +11,21 @@
 #include <sys/stat.h>
 #include <stdlib.h>
 #include <pthread.h>
-#include "libc.h"
+#include "lock.h"
+#include "fork_impl.h"
 
-char *__shm_mapname(const char *, char *);
+#define malloc __libc_malloc
+#define calloc __libc_calloc
+#define realloc undef
+#define free undef
 
 static struct {
        ino_t ino;
        sem_t *sem;
        int refcnt;
 } *semtab;
-static int lock[2];
+static volatile int lock[1];
+volatile int *const __sem_open_lockptr = lock;
 
 #define FLAGS (O_RDWR|O_NOFOLLOW|O_CLOEXEC|O_NONBLOCK)
 
@@ -67,23 +72,23 @@ sem_t *sem_open(const char *name, int flags, ...)
 
        flags &= (O_CREAT|O_EXCL);
 
+       pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
+
        /* Early failure check for exclusive open; otherwise the case
         * where the semaphore already exists is expensive. */
        if (flags == (O_CREAT|O_EXCL) && access(name, F_OK) == 0) {
                errno = EEXIST;
-               return SEM_FAILED;
+               goto fail;
        }
 
-       pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
-
        for (;;) {
                /* If exclusive mode is not requested, try opening an
                 * existing file first and fall back to creation. */
                if (flags != (O_CREAT|O_EXCL)) {
                        fd = open(name, FLAGS);
                        if (fd >= 0) {
-                               if ((map = mmap(0, sizeof(sem_t), PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0)) == MAP_FAILED ||
-                                   fstat(fd, &st) < 0) {
+                               if (fstat(fd, &st) < 0 ||
+                                   (map = mmap(0, sizeof(sem_t), PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0)) == MAP_FAILED) {
                                        close(fd);
                                        goto fail;
                                }
@@ -123,9 +128,10 @@ sem_t *sem_open(const char *name, int flags, ...)
                        goto fail;
                }
                close(fd);
-               if (link(tmp, name) == 0) break;
-               e = errno;
+               e = link(tmp, name) ? errno : 0;
                unlink(tmp);
+               if (!e) break;
+               munmap(map, sizeof(sem_t));
                /* Failure is only fatal when doing an exclusive open;
                 * otherwise, next iteration will try to open the
                 * existing file. */
@@ -153,6 +159,9 @@ sem_t *sem_open(const char *name, int flags, ...)
 
 fail:
        pthread_setcancelstate(cs, 0);
+       LOCK(lock);
+       semtab[slot].sem = 0;
+       UNLOCK(lock);
        return SEM_FAILED;
 }
 
@@ -161,10 +170,12 @@ int sem_close(sem_t *sem)
        int i;
        LOCK(lock);
        for (i=0; i<SEM_NSEMS_MAX && semtab[i].sem != sem; i++);
-       if (!--semtab[i].refcnt) {
-               semtab[i].sem = 0;
-               semtab[i].ino = 0;
+       if (--semtab[i].refcnt) {
+               UNLOCK(lock);
+               return 0;
        }
+       semtab[i].sem = 0;
+       semtab[i].ino = 0;
        UNLOCK(lock);
        munmap(sem, sizeof *sem);
        return 0;