[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260903070031.GO3542221@port70.net>
Date: Thu, 3 Sep 2026 09:00:31 +0200
From: Szabolcs Nagy <nsz@...t70.net>
To: Colin Cross <ccross@...roid.com>
Cc: musl@...ts.openwall.com
Subject: Re: Fix deadlock in timer_create when syscall fails
* Colin Cross <ccross@...roid.com> [2026-09-02 13:59:23 -0700]:
> timer_create can deadlock when it sets td->cancel = 1 to cancel the
> child thread before the child thread has reached sem_wait. sem_wait
> is a cancellation point, so if td->cancel is set the child thread will
> exit and never reach sem_post(&args->sem2), and the parent thread will
> wait forever on sem_wait(&args.sem2).
>
> This was observed in a test that called
> timer_create(CLOCK_BOOTTIME_ALARM, SIGEV_THREAD, ...) without
> CAP_WAKE_ALARM, causing the kernel to return EPERM.
...
> * self->cancel set by the parent if timer creation failed or
> * self->timer_id if it succeeded, and informs the parent that
> * we are done accessing the arguments so that the parent can
> - * proceed past their block lifetime. */
> + * proceed past their block lifetime. Disable cancellation,
> + * if the parent thread cancels this thread before this thread
> + * calls sem_post it will deadlock. */
> + __pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
> while (sem_wait(&args->sem1));
> sem_post(&args->sem2);
> + __pthread_setcancelstate(cs, 0);
>
> if (self->cancel)
> return 0;
it seems
commit 3ad3fa962efee12067d68c3405a537dce156a7ac
fix thread leak on timer_create(SIGEV_THREAD) failure
(ab)used self->cancel to mark timer_create failures, because
the obvious self->timer_id < 0 can also mean deleted timer.
then
commit cde213f9c3ac1aa168581222edee6a6642113323
timer_create: replace pthread barrier with semaphores for thread start
changed the sync to two sems, introducing the cancel deadlock,
but i think it now allows self->timer_id to distinguish early
failure from timer_delete: child can read it before allowing
the parent to move on.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
