Bug 772

Summary: possible deadlock on double-free logging
Product: glibc Reporter: Jakub Bogusz <qboosh>
Component: libcAssignee: GOTO Masanori <gotom>
Status: RESOLVED DUPLICATE    
Severity: normal CC: glibc-bugs
Priority: P2 Flags: fweimer: security-
Version: 2.3.4   
Target Milestone: ---   
Host: Target:
Build: Last reconfirmed:
Project(s) to access: ssh public key:

Description Jakub Bogusz 2005-02-26 21:35:41 UTC 
_int_free() (malloc/malloc.c), which is called from free() with arena mutex
locked, checks and eventually prints/logs error message.
So if malloc_printerr() handling do some malloc()/free() on the same memory
arena, deadlock can occur.
vsyslog() can call free() during tz manipulation.

Yes, this deadlock is triggered by buggy code.
But it's all inside libc, not caused by actual memory corruption.
Comment 1 Jakub Bogusz 2005-02-26 21:38:15 UTC 
Oops, refreshed wrong page...

*** This bug has been marked as a duplicate of 770 ***