[Bug time/19821] New: Timer crash when repeat create-start-delete several times

["anton.gritsevich at gmail dot com" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=19821

            Bug ID: 19821
           Summary: Timer crash when repeat create-start-delete several
                    times
           Product: glibc
           Version: 2.21
            Status: NEW
          Severity: normal
          Priority: P2
         Component: time
          Assignee: unassigned at sourceware dot org
          Reporter: anton.gritsevich at gmail dot com
  Target Milestone: ---

If run this code on Ubuntu 15.04 and glibc 2.21 it will crash with SIGSEGV.



#include <pthread.h>
#include <sys/signal.h>
#include <stdio.h>
#include <assert.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>

#include <sys/resource.h>

const int TIMER_COUNT = 300;

pthread_mutex_t mutex[TIMER_COUNT] = {PTHREAD_MUTEX_INITIALIZER};
pthread_cond_t cond[TIMER_COUNT] = {PTHREAD_COND_INITIALIZER};

void timer_thread(sigval signal_value) {
  int status;

  // printf ("Prepare wait unlock mutex %d\n", signal_value.sival_int);
  status = pthread_mutex_lock(&mutex[signal_value.sival_int]);
  assert(!status && "Lock mutex");

  status = pthread_cond_signal(&cond[signal_value.sival_int]);
  assert(!status && "Signal condition");

  //printf ("Timer %d, thread id %ld\n", signal_value.sival_int,
pthread_self());

  status = pthread_mutex_unlock(&mutex[signal_value.sival_int]);
  assert(!status && "Unlock mutex");
}

int main(int argc, char* argv[]) {
  for (int i = 0; i < 10000; i++) {
    printf("\n~~~~~~~ Iteration #%06d ~~~~~~~~~~~~~\n", i + 1);

    int status = 0;

    timer_t timer_id[TIMER_COUNT] = {};
    memset(&timer_id[0], 0, sizeof(timer_t) * TIMER_COUNT);

    printf("Start creating timers! \n");

    for (int j = 0; j < TIMER_COUNT; j++) {
      //printf("      ___Subiteration #%02d___\n", j + 1);

      itimerspec ts = {};
      sigevent se = {};

      memset(&ts, 0, sizeof(itimerspec));
      memset(&se, 0, sizeof(sigevent));

      se.sigev_notify = SIGEV_THREAD;
      se.sigev_value.sival_int = j;
      se.sigev_notify_function = timer_thread;

      // Specify a repeating timer that fires each 100000 nanosec.
      ts.it_value.tv_sec = 0;
      ts.it_value.tv_nsec = 1000000;
      ts.it_interval.tv_sec = 0;
      ts.it_interval.tv_nsec = 1000000;

      // printf ("Creating timer \n");
      status = timer_create(CLOCK_REALTIME, &se, &timer_id[j]);
      assert(!status && "Create timer");

      //printf ("Setting timer %#08x...\n", *(int*)&timer_id[j]);
      status = timer_settime(timer_id[j], 0, &ts, 0);
      assert(!status && "Set timer");
    }

    printf("All timers has already started! \n");

    for (int j = 0; j < TIMER_COUNT; j++) {
      status = pthread_mutex_lock(&mutex[j]);
      assert(!status && "Lock mutex");

      status = pthread_cond_wait(&cond[j], &mutex[j]);
      assert(!status && "Wait on condition");

      status = pthread_mutex_unlock(&mutex[j]);
      assert(!status && "Unlock mutex");
    }
    printf("All timers done! \n");

    printf("Start timers deleted! \n");
    for (int j = 0; j < TIMER_COUNT; j++) {
      // stop and delete
      //printf("Delete timer %#08x...\n", *(int*)&timer_id[j]);

      status = pthread_mutex_lock(&mutex[j]);
      assert(!status && "Lock mutex");

      status = timer_delete(timer_id[j]);
      assert(!status && "Fail delete timer");

      status = pthread_mutex_unlock(&mutex[j]);
      assert(!status && "Unlock mutex");
    }
    printf("All timers deleted! \n");
  }
  printf("Success!\n");
  return 0;
}

-- 
You are receiving this mail because:
You are on the CC list for the bug.