Bug 10919 - pthread_cancel segfault when used in shared library
Summary: pthread_cancel segfault when used in shared library
Status: RESOLVED WORKSFORME
Alias: None
Product: glibc
Classification: Unclassified
Component: nptl (show other bugs)
Version: 2.8
: P2 normal
Target Milestone: ---
Assignee: Ulrich Drepper
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-11-08 16:20 UTC by Franz Hollerer
Modified: 2014-07-01 05:28 UTC (History)
2 users (show)

See Also:
Host: i686-linux-gnu
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments
short application to show the problem (1.50 KB, application/x-compressed-tar)
2009-11-08 16:22 UTC, Franz Hollerer
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Franz Hollerer 2009-11-08 16:20:30 UTC
There is a problem with thread cancellation, stack unwinding and shared
libraries. (Tested on Ubuntu 8.10 with gcc 4.3.2-1ubuntu12, libc-2.8.90.so and
Ubuntu 7.10.)

If pthread_cancel is called in the library, a segmentation fault occurs. For
static linkage the problem does not occur and the thread is canceled as expected.

In the attachment you can find a demo application reproducing the problem. It
consists of an Makefile and the source files:
main.cpp 
thread_test_lib.h   - library interface
thread_test_lib.cpp - library source

If you invoke make the shared library libthread_test_lib.so and the application
thread_test are built. Make also generates thread_test_static which is the same
application, but statically linked.

The library provides the functions thread_setup() to create an internal task and
thread_cleanup() to cancel the task.

When thread_test is executed a segmentation fault occurs:

./thread_test
thread_setup()
run_thread::task() started
thread_cleanup()
Segmentation fault (core dumped)

According to the core dump the segmentation fault is inside task().

It can be observed that no segmentation fault occurs for one of the following
conditions:
- ./thread_test_static is called instead of ./thread_test
- the line "std::string s..." inside task() (see thread_test_lib.cpp) is
commented out
- usleep() in task() is replaced by sleep() or pthread_testcancel
- usleep() in task() is called indirectly via a wrapper function
Comment 1 Franz Hollerer 2009-11-08 16:22:06 UTC
Created attachment 4368 [details]
short application to show the problem
Comment 2 Ulrich Drepper 2009-11-19 17:54:42 UTC
I see no problem.  The program terminates normally.  Report this to your
distribution maker.