prevent code from running under a thread id which already gave ESRCH

[musl] / src / thread / pthread_create.c

diff --git a/src/thread/pthread_create.c b/src/thread/pthread_create.c
index 1e55a6f..6e49acd 100644 (file)
--- a/src/thread/pthread_create.c
+++ b/src/thread/pthread_create.c
@@ -12,7 +12,7 @@ weak_alias(dummy_0, __pthread_tsd_run_dtors);
 _Noreturn void pthread_exit(void *result)
 {
        pthread_t self = pthread_self();
-       int n;
+       sigset_t set;
 
        self->result = result;
 
@@ -30,17 +30,43 @@ _Noreturn void pthread_exit(void *result)
        /* Mark this thread dead before decrementing count */
        __lock(self->killlock);
        self->dead = 1;
+
+       /* Block all signals before decrementing the live thread count.
+        * This is important to ensure that dynamically allocated TLS
+        * is not under-allocated/over-committed, and possibly for other
+        * reasons as well. */
+       __syscall(SYS_rt_sigprocmask, SIG_BLOCK, SIGALL_SET, &set, _NSIG/8);
+
+       /* Wait to unlock the kill lock, which governs functions like
+        * pthread_kill which target a thread id, until signals have
+        * been blocked. This precludes observation of the thread id
+        * as a live thread (with application code running in it) after
+        * the thread was reported dead by ESRCH being returned. */
        __unlock(self->killlock);
 
-       do n = libc.threads_minus_1;
-       while (n && a_cas(&libc.threads_minus_1, n, n-1)!=n);
-       if (!n) exit(0);
+       /* It's impossible to determine whether this is "the last thread"
+        * until performing the atomic decrement, since multiple threads
+        * could exit at the same time. For the last thread, revert the
+        * decrement and unblock signals to give the atexit handlers and
+        * stdio cleanup code a consistent state. */
+       if (a_fetch_add(&libc.threads_minus_1, -1)==0) {
+               libc.threads_minus_1 = 0;
+               __syscall(SYS_rt_sigprocmask, SIG_SETMASK, &set, 0, _NSIG/8);
+               exit(0);
+       }
 
        if (self->detached && self->map_base) {
-               if (self->detached == 2)
-                       __syscall(SYS_set_tid_address, 0);
-               __syscall(SYS_rt_sigprocmask, SIG_BLOCK,
-                       SIGALL_SET, 0, __SYSCALL_SSLEN);
+               /* Detached threads must avoid the kernel clear_child_tid
+                * feature, since the virtual address will have been
+                * unmapped and possibly already reused by a new mapping
+                * at the time the kernel would perform the write. In
+                * the case of threads that started out detached, the
+                * initial clone flags are correct, but if the thread was
+                * detached later (== 2), we need to clear it here. */
+               if (self->detached == 2) __syscall(SYS_set_tid_address, 0);
+
+               /* The following call unmaps the thread's stack mapping
+                * and then exits without touching the stack. */
                __unmapself(self->map_base, self->map_size);
        }
 
@@ -69,11 +95,11 @@ static int start(void *p)
                        pthread_exit(0);
                }
                __syscall(SYS_rt_sigprocmask, SIG_SETMASK,
-                       self->sigmask, 0, __SYSCALL_SSLEN);
+                       self->sigmask, 0, _NSIG/8);
        }
        if (self->unblock_cancel)
                __syscall(SYS_rt_sigprocmask, SIG_UNBLOCK,
-                       SIGPT_SET, 0, __SYSCALL_SSLEN);
+                       SIGPT_SET, 0, _NSIG/8);
        pthread_exit(self->start(self->start_arg));
        return 0;
 }
@@ -101,7 +127,7 @@ int pthread_create(pthread_t *restrict res, const pthread_attr_t *restrict attrp
        int ret;
        size_t size, guard;
        struct pthread *self = pthread_self(), *new;
-       unsigned char *map = 0, *stack = 0, *tsd = 0;
+       unsigned char *map = 0, *stack = 0, *tsd = 0, *stack_limit;
        unsigned flags = 0x7d8f00;
        int do_sched = 0;
        pthread_attr_t attr = {0};
@@ -123,6 +149,7 @@ int pthread_create(pthread_t *restrict res, const pthread_attr_t *restrict attrp
                size_t need = libc.tls_size + __pthread_tsd_size;
                size = attr._a_stacksize + DEFAULT_STACK_SIZE;
                stack = (void *)(attr._a_stackaddr & -16);
+               stack_limit = (void *)(attr._a_stackaddr - size);
                /* Use application-provided stack for TLS only when
                 * it does not take more than ~12% or 2k of the
                 * application's stack space. */
@@ -142,22 +169,27 @@ int pthread_create(pthread_t *restrict res, const pthread_attr_t *restrict attrp
        if (!tsd) {
                if (guard) {
                        map = mmap(0, size, PROT_NONE, MAP_PRIVATE|MAP_ANON, -1, 0);
-                       if (map == MAP_FAILED) return EAGAIN;
+                       if (map == MAP_FAILED) goto fail;
                        if (mprotect(map+guard, size-guard, PROT_READ|PROT_WRITE)) {
                                munmap(map, size);
-                               return EAGAIN;
+                               goto fail;
                        }
                } else {
                        map = mmap(0, size, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0);
-                       if (map == MAP_FAILED) return EAGAIN;
+                       if (map == MAP_FAILED) goto fail;
                }
                tsd = map + size - __pthread_tsd_size;
-               if (!stack) stack = tsd - libc.tls_size;
+               if (!stack) {
+                       stack = tsd - libc.tls_size;
+                       stack_limit = map + guard;
+               }
        }
 
        new = __copy_tls(tsd - libc.tls_size);
        new->map_base = map;
        new->map_size = size;
+       new->stack = stack;
+       new->stack_size = stack - stack_limit;
        new->pid = self->pid;
        new->errno_ptr = &new->errno_val;
        new->start = entry;
@@ -171,7 +203,7 @@ int pthread_create(pthread_t *restrict res, const pthread_attr_t *restrict attrp
        if (attr._a_sched) {
                do_sched = new->startlock[0] = 1;
                __syscall(SYS_rt_sigprocmask, SIG_BLOCK,
-                       SIGALL_SET, self->sigmask, __SYSCALL_SSLEN);
+                       SIGALL_SET, new->sigmask, _NSIG/8);
        }
        new->unblock_cancel = self->cancel;
        new->canary = self->canary;
@@ -183,7 +215,7 @@ int pthread_create(pthread_t *restrict res, const pthread_attr_t *restrict attrp
 
        if (do_sched) {
                __syscall(SYS_rt_sigprocmask, SIG_SETMASK,
-                       new->sigmask, 0, __SYSCALL_SSLEN);
+                       new->sigmask, 0, _NSIG/8);
        }
 
        if (ret < 0) {
@@ -202,4 +234,7 @@ int pthread_create(pthread_t *restrict res, const pthread_attr_t *restrict attrp
 
        *res = new;
        return 0;
+fail:
+       __release_ptc();
+       return EAGAIN;
 }