fix pthread_detach inadvertently acting as cancellation point in race case
authorRich Felker <dalias@aerifal.cx>
Sat, 11 Feb 2023 14:54:12 +0000 (09:54 -0500)
committerRich Felker <dalias@aerifal.cx>
Sat, 11 Feb 2023 18:00:22 +0000 (13:00 -0500)
disabling cancellation around the pthread_join call seems to be the
safest and logically simplest fix. i believe it would also be possible
to just perform the unmap directly here after __tl_sync, removing the
dependency on pthread_join, but such an approach duplicately encodes a
lot more implementation assumptions.

src/thread/pthread_detach.c

index 77772af..d73a500 100644 (file)
@@ -5,8 +5,12 @@ static int __pthread_detach(pthread_t t)
 {
        /* If the cas fails, detach state is either already-detached
         * or exiting/exited, and pthread_join will trap or cleanup. */
-       if (a_cas(&t->detach_state, DT_JOINABLE, DT_DETACHED) != DT_JOINABLE)
-               return __pthread_join(t, 0);
+       if (a_cas(&t->detach_state, DT_JOINABLE, DT_DETACHED) != DT_JOINABLE) {
+               int cs;
+               __pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
+               __pthread_join(t, 0);
+               __pthread_setcancelstate(cs, 0);
+       }
        return 0;
 }