[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <OF1FE04957.E10407EE-ONC1258480.00333ED5-C1258480.00376A8A@avm.de>
Date: Wed, 25 Sep 2019 12:05:18 +0200
From: d.dorau@....de
To: musl@...ts.openwall.com
Subject: Bug report: Memory corrupion due to stale robust_list.head pointer
Hello,
I recently came across a memory corruption in the member "tsd" of struct
pthread
in a scenario where a pthread mutex is intentionally held during fork().
I experienced this using the lastest release 1.1.23.
I found that during fork musl resets self->robust_list.pending and
self->robust_list.off,
but not the robust_list.head. The stale pointer to the previously held and
reset
mutex turned out to be the cause for the following corruption.
I therefore suggest to also reset the list head on fork as such:
--- a/src/process/fork.c.orig 2019-09-23 11:41:01.381626360 +0200
+++ b/src/process/fork.c 2019-09-23 11:41:26.657819473 +0200
@@ -27,6 +27,7 @@
self->tid = __syscall(SYS_gettid);
self->robust_list.off = 0;
self->robust_list.pending = 0;
+ self->robust_list.head = &self->robust_list.head;
self->next = self->prev = self;
__thread_list_lock = 0;
libc.threads_minus_1 = 0;
This resolves the issue.
I am very well aware of the fact that aquiring a mutex during fork and
re-initializing
in the child appears to result in undefined behaviour (as of
pthread_mutex_init(3posix))
or to be controversial at least.
However I believe that it should't result in a memory corruption as a
result.
To reproduce I wrote a small example which triggers and shows the
curruption.
It also contains a description of the program flow and memory corruption.
Please find it attached to this mail.
Please note that the routine to print the robust_list is hacked using
hardcoded
offsets which are aimed at my 32-Bit platform.
Best regards,
Daniel
--
AVM Audiovisuelles Marketing und Computersysteme GmbH
Alt-Moabit 95, 10559 Berlin
HRB 23075 AG Charlottenburg
Geschäftsführer: Johannes Nill
Content of type "text/html" skipped
Download attachment "pthread_fork_demo.c" of type "application/octet-stream" (9818 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
