[Bug malloc/19243] New: reused_arena can pick an arena on the free list

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=19243

            Bug ID: 19243
           Summary: reused_arena can pick an arena on the free list
           Product: glibc
           Version: 2.23
            Status: NEW
          Severity: normal
          Priority: P1
         Component: malloc
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---
             Flags: security-

If reused_arena picks an arena on the free list (which means that arena_get2
did not see it yet, and there was a concurrent thread exit, updating the free
list), it will increase the thread reference count of the arena.  At this
point, this invariant in get_free_list no longer holds:

821               /* Arenas on the free list are not attached to any thread. 
*/
822               assert (result->attached_threads == 0);

Therefore, the assert is incorrect.  I am not sure if we should simply remove
it and not change anything, or if we should change reused_arena to avoid this
race condition.

-- 
You are receiving this mail because:
You are on the CC list for the bug.