Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20230601201659.GN4163@brightrain.aerifal.cx>
Date: Thu, 1 Jun 2023 16:17:01 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Re: [PATCH] [v2] make clone() usable

On Thu, Jun 01, 2023 at 04:08:07PM -0400, Rich Felker wrote:
> On Thu, Jun 01, 2023 at 01:12:57PM +0300, Alexey Izbyshev wrote:
> > On 2023-05-31 02:35, Rich Felker wrote:
> > >As discussed before (see the 2021 thread "Incorrect thread TID
> > >caching") clone() has been effectively unusable because it produces a
> > >child process in invalid state, with wrong tid in its thread
> > >structure, among other problems.
> > >
> > >The attached proposed patch attempts to make clone() usable by having
> > >it share the _Fork logic for establishing a consistent process state
> > >after forking, and also blocks use of flags which produce invalid
> > >state.
> > >
> > Tangentially, while thinking about this, I realized that because the
> > kernel clears the address of the exit futex on clone and _Fork
> > doesn't re-establish it, the following blocks forever:
> > 
> > void *thr(void *arg) {
> >         // Blocks in __tl_sync because __thread_list_lock is never
> > unlocked
> >         pthread_join(*(pthread_t *)arg, NULL));
> >         return NULL;
> > }
> > 
> > int main() {
> >         if (!fork()) {
> >                 static pthread_t pt;
> >                 pt = pthread_self();
> >                 pthread_create(&(pthread_t){0}, NULL, thr, &pt);
> >                 pthread_exit(NULL);
> >         }
> >         wait(NULL);
> > }
> > 
> > This could be fixed by the following change in _Fork.c:
> > 
> > -               self->tid = __syscall(SYS_gettid);
> > +               self->tid = __syscall(SYS_set_tid_address,
> > &__thread_list_lock);
> 
> Wow, I had no idea Linux's fork cleared the exit futex address. That's
> a big bug we've had around for nobody to have noticed...

Updated version with this fixed and checking for null stack.

View attachment "0001-fix-broken-thread-list-unlocking-after-fork.patch" of type "text/plain" (1107 bytes)

View attachment "0002-fix-public-clone-function-to-be-safe-and-usable-by-a.patch" of type "text/plain" (5781 bytes)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.