Bug 25098 - nptl: ctype classification functions are not AS-Safe
Summary: nptl: ctype classification functions are not AS-Safe
Alias: None
Product: glibc
Classification: Unclassified
Component: nptl (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: 2.32
Assignee: Florian Weimer
: 14830 (view as bug list)
Depends on:
Reported: 2019-10-11 11:19 UTC by Florian Weimer
Modified: 2021-05-27 00:32 UTC (History)
4 users (show)

See Also:
Last reconfirmed:
fweimer: security-


Note You need to log in before you can comment on or make changes to this bug.
Description Florian Weimer 2019-10-11 11:19:40 UTC
A signal can arrive on a new thread before __ctype_init has completed on that thread.

Pointed out by Mathieu Desnoyers as part of the rseq work.
Comment 1 Florian Weimer 2019-10-14 12:34:23 UTC
Patch posted: https://sourceware.org/ml/libc-alpha/2019-10/msg00383.html
Comment 2 Florian Weimer 2020-06-09 09:34:20 UTC
Fixed for glibc 2.32:

commit b3cae39dcbfa2432b3f3aa28854d8ac57f0de1b8
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon Apr 27 09:55:10 2020 +0200

    nptl: Start new threads with all signals blocked [BZ #25098]
    New threads inherit the signal mask from the current thread.  This
    means that signal handlers can run on the newly created thread
    immediately after the kernel has created the userspace thread, even
    before glibc has initialized the TCB.  Consequently, new threads can
    observe uninitialized ctype data, among other things.
    To address this, block all signals before starting the thread, and
    pass the original signal mask to the start routine wrapper.  On the
    new thread, first perform all thread initialization, and then unblock
    The cost of doing this is two rt_sigprocmask system calls on the old
    thread, and one rt_sigprocmask system call on the new thread.  (If
    there was a way to clone a new thread with a signals disabled, this
    could be brought down to one system call each.)  The thread descriptor
    increases in size, too, and sigset_t is fairly large.  This increase
    could be brought down by reusing space the in the descriptor which is
    not needed before running user code, or by switching to an internal
    sigset_t definition which only covers the signals supported by the
    kernel definition.  (Part of the thread descriptor size increase is
    already offset by reduced stack usage in the thread start wrapper
    routine after this commit.)
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>

Also needs the following regression fix (plus its dependencies):

commit ba9f6ee9bb8a894c9e2fb715edf693dd157b420a
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue May 19 12:03:44 2020 +0200

    Linux: Use __pthread_attr_setsigmask_internal for timer helper thread
    timer_create needs to create threads with all signals blocked,
    including SIGTIMER (which happens to equal SIGCANCEL).
    Fixes commit b3cae39dcbfa2432b3f3aa28854d8ac57f0de1b8 ("nptl: Start
    new threads with all signals blocked [BZ #25098]").
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Comment 3 Adhemerval Zanella 2021-05-27 00:32:40 UTC
*** Bug 14830 has been marked as a duplicate of this bug. ***