[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAMbhsRSEjjTUL=Y_VR--mY0i6zXPcWkFbENk_U+c1afnk6pC0w@mail.gmail.com>
Date: Thu, 3 Sep 2026 10:26:12 -0700
From: Colin Cross <ccross@...roid.com>
To: musl@...ts.openwall.com
Subject: Re: Fix deadlock in timer_create when syscall fails
On Thu, Sep 3, 2026 at 12:00 AM Szabolcs Nagy <nsz@...t70.net> wrote:
>
> * Colin Cross <ccross@...roid.com> [2026-09-02 13:59:23 -0700]:
> > timer_create can deadlock when it sets td->cancel = 1 to cancel the
> > child thread before the child thread has reached sem_wait. sem_wait
> > is a cancellation point, so if td->cancel is set the child thread will
> > exit and never reach sem_post(&args->sem2), and the parent thread will
> > wait forever on sem_wait(&args.sem2).
> >
> > This was observed in a test that called
> > timer_create(CLOCK_BOOTTIME_ALARM, SIGEV_THREAD, ...) without
> > CAP_WAKE_ALARM, causing the kernel to return EPERM.
> ...
> > * self->cancel set by the parent if timer creation failed or
> > * self->timer_id if it succeeded, and informs the parent that
> > * we are done accessing the arguments so that the parent can
> > - * proceed past their block lifetime. */
> > + * proceed past their block lifetime. Disable cancellation,
> > + * if the parent thread cancels this thread before this thread
> > + * calls sem_post it will deadlock. */
> > + __pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
> > while (sem_wait(&args->sem1));
> > sem_post(&args->sem2);
> > + __pthread_setcancelstate(cs, 0);
> >
> > if (self->cancel)
> > return 0;
>
> it seems
>
> commit 3ad3fa962efee12067d68c3405a537dce156a7ac
> fix thread leak on timer_create(SIGEV_THREAD) failure
>
> (ab)used self->cancel to mark timer_create failures, because
> the obvious self->timer_id < 0 can also mean deleted timer.
> then
>
> commit cde213f9c3ac1aa168581222edee6a6642113323
> timer_create: replace pthread barrier with semaphores for thread start
>
> changed the sync to two sems, introducing the cancel deadlock,
> but i think it now allows self->timer_id to distinguish early
> failure from timer_delete: child can read it before allowing
> the parent to move on.
Makes sense. The attached v2 reads self->timer_id between the
sem_wait and sem_post to detect the syscall failure case.
View attachment "0001-SIGEV_THREAD-timers-fix-deadlock-when-timer_create-s.patch" of type "text/x-patch" (2680 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
