[Bug nptl/19951] Use after free in pthread_detach

[s.griebel at celonis dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=19951

Simon Griebel <s.griebel at celonis dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |s.griebel at celonis dot com

--- Comment #4 from Simon Griebel <s.griebel at celonis dot com> ---
I was able to reproduce this issue using Pavel's approach on glibc 2.41 (using
a breakpoint after the compare exchange instead of stepping through it). I was
also able to reproduce it with a test program without gdb, but sadly this does
not seem to work anymore. I am not sure whether I made a subtle change in the
test program or in the execution environment.
In general this issue seems to be very hard to run into on a normal desktop
machine, but we actually see it quite a bit on numa nodes (probably still very
infrequent per actual detach call). There is also an open tbb issue that is
almost certainly caused by this bug:
https://github.com/uxlfoundation/oneTBB/issues/1758.
I agree with Adhemerval that a fix likely has to entail additional states of
the joinid attribute (or a new attribute with similar semantics), but from my
high level understanding of the code one such state should be enough. When a
thread is at the end of its shut down routine (i.e. it will not touch the
thread state again) and if it still in the joinable state, it sets the joinid
to a new "exited" state. If the detacher sees this, it knows that it can safely
free the thread data (and for the joiner it should not really make a big
difference). As said, I have not really looked into the code enough to check
whether this is really enough.
Until this is fixed, I see only three workarounds (partially already
mentioned):
a) Always use join over detach
b) Detach threads on startup with pthread_attr
c) Ensure that the detach and shutdown can never race

-- 
You are receiving this mail because:
You are on the CC list for the bug.