[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAHtxdDceo++j-LeHAMOn-psO0ECrf05Z63Tahtun_tZXQrX35Q@mail.gmail.com>
Date: Sun, 21 Dec 2025 04:00:28 +0200
From: Sergey Safarov <s.safarov@...il.com>
To: musl@...ts.openwall.com
Subject: pthread_getspecific: need to check tsd_used before deref pointers
I caught a coredump when Kamailio started under Alpine Linux.
This happens because pthread_getspecific try deref empty array
https://git.musl-libc.org/cgit/musl/tree/src/thread/pthread_getspecific.c#n7
.
Here is gdb output when disabled optimisation.
(gdb) p self
$5 = (struct __pthread *) 0x7fcbdf4ac588 <builtin_tls+136>
(gdb) p *self
$6 = {self = 0x7fcbdf4ac588 <builtin_tls+136>, dtv = 0x7fcbdf4ac500
<builtin_tls>, prev = 0x7fcbdf4ac588 <builtin_tls+136>, next =
0x7fcbdf4ac588 <builtin_tls+136>, sysinfo = 0,
canary = 5087873141211791600, tid = 30511, errno_val = 9, detach_state =
2, cancel = 0, canceldisable = 0 '\000', cancelasync = 0 '\000', tsd_used =
0 '\000', dlerror_flag = 0 '\000',
map_base = 0x0, map_size = 0, stack = 0x0, stack_size = 0, guard_size =
0, result = 0x0, cancelbuf = 0x0, tsd = 0x0, robust_list = {head =
0x7fcbdf4ac610 <builtin_tls+272>, off = 0,
pending = 0x0}, h_errno_val = 0, timer_id = 0, locale = 0x7fcbdf4aa8b8
<__libc+56>, killlock = {0}, dlerror_buf = 0x0, stdio_locks = 0x0}
(gdb) p self->tsd
$7 = (void **) 0x0
(gdb) p self->tsd[0]
Cannot access memory at address 0x0
If you check pthread_setspecific function
https://git.musl-libc.org/cgit/musl/tree/src/thread/pthread_setspecific.c#n9
Then you see "self->tsd_used = 1;" to flag "tsd" structure is initialized.
Proable self->tsd_used before returning "self->tsd[k];".
Related
https://github.com/kamailio/kamailio/issues/4534
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
