Segfault in pthread_sigqueue() or sigtimewait()

[Takashi Yano]

On Thu, 14 Nov 2024 13:55:36 +0100
Christian Franke wrote:
> After enabling the usage of pthread_sigqueue() in stress-ng, 'stress-ng 
> --pthread ...' occasionally reports that child processes failed with 
> SIGSEGV.
> 
> The problem is unrelated to the recent fix of the signature of 
> pthread_sigqueue():
> https://cygwin.com/git/?p=newlib-cygwin.git;a=commit;h=1e8c92e
> 
> It could be reproduced with Cygwin 3.5.4-1 and with current 3.6.0 TEST 
> release if the signature is adjusted.
> 
> Testcase (attached):
> 
> $ gcc -O2 -o sigfault sigfault.c # Add -DBETA if compiling for a TEST 
> release
> 
> $ strace -o trace.log ./sigfault
> pthread_create({0xa000188d0}, ...)=0
> pthread_sigqueue(0xa000188d0, SIGUSR1, .)
> sigtimedwait(...)=30 (errno=0)
> ...
> sigtimedwait(...)=30 (errno=0)
> pthread_sigqueue(0xa000188d0, SIGUSR1, .)=0
> pthread_join(0xa000188d0, .)=0
> pthread_create({0xa000188d0}, ...)=0
> pthread_sigqueue(0xa000188d0, SIGUSR1, .)
> sigtimedwait(...)=30 (errno=0)
> pthread_sigqueue(0xa000188d0, SIGUSR1, .)=0
> pthread_join(0xa000188d0, .)=0
> pthread_create({0xa000188d0}, ...)=0
> pthread_sigqueue(0xa000188d0, SIGUSR1, .)
> Segmentation fault
> 
> $ cat trace.log
> ...
>     78  103937 [main] sigfault 2074 sig_send: Waiting for pack.wakeup 0x21C
>     80  104017 [sig] sigfault 2074 sigpacket::process: signal 30 processing
>    147  104164 [sigfault] sigfault 2074 __set_errno: int 
> sigwait_common(const sigset_t*, siginfo_t*, PLARGE_INTEGER):643 setting 
> errno 11
>    103  104267 [sig] sigfault 2074 sigpacket::process: signal 30, signal 
> handler 0x1
>     84  104351 [sigfault] sigfault 2074 sigwait_common: returning signal -1
>     81  104432 [sig] sigfault 2074 sigpacket::setup_handler: controlled 
> interrupt. stackptr 0x7FFDFE220, stack 0x7FFDFE218, stackptr[-1] 0x100401109
>     78  104510 [sig] sigfault 2074 proc_subproc: args: 4, 1
>     74  104584 [sig] sigfault 2074 proc_subproc: clear waiting threads
>     71  104655 [sig] sigfault 2074 proc_subproc: finished clearing
>     70  104725 [sig] sigfault 2074 proc_subproc: returning 1
>    125  104850 [sig] sigfault 2074 _cygtls::interrupt_setup: armed 
> signal_arrived 0x24C, signal 30
>     74  104924 [sig] sigfault 2074 sigpacket::setup_handler: signal 30 
> delivered
>     83  105007 [sigfault] sigfault 2074 set_process_mask_delta: oldmask 
> 0, newmask 20000000, deltamask 20000000
> --- Process 9568 (pid: 2074), exception c0000005 at 0000000000000001
>     80  105087 [sig] sigfault 2074 sigpacket::process: returning 1
> --- Process 9568 (pid: 2074) thread 7320 exited with status 0xc0000005
> --- Process 9568 (pid: 2074) thread 8928 exited with status 0xc0000005
> --- Process 9568 (pid: 2074) thread 6792 exited with status 0xc0000005
> --- Process 9568 (pid: 2074) thread 5020 exited with status 0xc0000005
> --- Process 9568 thread 9020 exited with status 0xc0000005
> --- Process 9568 exited with status 0xc0000005
> 
> I guess the problem occurs because pthread_sigqueue() is sometimes 
> issued after the thread function already returned. The thread pointer 
> should be valid until pthread_join() is called. Sorry if I missed something.

Thansk for the report and especially for the test case.
I could reporduce the problem using your test case.

I'll look into this.

-- 
Takashi Yano <takashi.yano@nifty.ne.jp>