[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAMbhsRRCtrooLOVfm8Bmhi40s9=abnN3psn+Ooz=ma6xWOsdJg@mail.gmail.com>
Date: Wed, 2 Sep 2026 13:59:23 -0700
From: Colin Cross <ccross@...roid.com>
To: musl@...ts.openwall.com
Subject: Fix deadlock in timer_create when syscall fails
timer_create can deadlock when it sets td->cancel = 1 to cancel the
child thread before the child thread has reached sem_wait. sem_wait
is a cancellation point, so if td->cancel is set the child thread will
exit and never reach sem_post(&args->sem2), and the parent thread will
wait forever on sem_wait(&args.sem2).
This was observed in a test that called
timer_create(CLOCK_BOOTTIME_ALARM, SIGEV_THREAD, ...) without
CAP_WAKE_ALARM, causing the kernel to return EPERM.
The attached patch uses
__pthread_setcancelstate(PTHREAD_CANCEL_DISABLE) to disable
cancellation until after the child thread has synchronized with the
parent thread.
View attachment "0001-SIGEV_THREAD-timers-block-cancellation-when-operatin.patch" of type "text/x-patch" (1701 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
