[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20251221020956.GP1827@brightrain.aerifal.cx>
Date: Sat, 20 Dec 2025 21:09:56 -0500
From: Rich Felker <dalias@...c.org>
To: Sergey Safarov <s.safarov@...il.com>
Cc: musl@...ts.openwall.com
Subject: Re: pthread_getspecific: need to check tsd_used before deref
pointers
On Sun, Dec 21, 2025 at 04:00:28AM +0200, Sergey Safarov wrote:
> I caught a coredump when Kamailio started under Alpine Linux.
> This happens because pthread_getspecific try deref empty array
>
> https://git.musl-libc.org/cgit/musl/tree/src/thread/pthread_getspecific.c#n7
> .
>
> Here is gdb output when disabled optimisation.
>
> (gdb) p self
> $5 = (struct __pthread *) 0x7fcbdf4ac588 <builtin_tls+136>
> (gdb) p *self
> $6 = {self = 0x7fcbdf4ac588 <builtin_tls+136>, dtv = 0x7fcbdf4ac500
> <builtin_tls>, prev = 0x7fcbdf4ac588 <builtin_tls+136>, next =
> 0x7fcbdf4ac588 <builtin_tls+136>, sysinfo = 0,
> canary = 5087873141211791600, tid = 30511, errno_val = 9, detach_state =
> 2, cancel = 0, canceldisable = 0 '\000', cancelasync = 0 '\000', tsd_used =
> 0 '\000', dlerror_flag = 0 '\000',
> map_base = 0x0, map_size = 0, stack = 0x0, stack_size = 0, guard_size =
> 0, result = 0x0, cancelbuf = 0x0, tsd = 0x0, robust_list = {head =
> 0x7fcbdf4ac610 <builtin_tls+272>, off = 0,
> pending = 0x0}, h_errno_val = 0, timer_id = 0, locale = 0x7fcbdf4aa8b8
> <__libc+56>, killlock = {0}, dlerror_buf = 0x0, stdio_locks = 0x0}
> (gdb) p self->tsd
> $7 = (void **) 0x0
> (gdb) p self->tsd[0]
> Cannot access memory at address 0x0
>
> If you check pthread_setspecific function
> https://git.musl-libc.org/cgit/musl/tree/src/thread/pthread_setspecific.c#n9
>
> Then you see "self->tsd_used = 1;" to flag "tsd" structure is initialized.
>
> Proable self->tsd_used before returning "self->tsd[k];".
self->tsd_used does not flag that self->tsd has been initialized. It
flags that a key has been set for the thread, so that it's necessary
to iterate through the keys and check for the need to run dtors when
the thread exits. This is purely an optimization to avoid that time
cost in threads/programs that don't use tsd.
The bug in Kamailio is that it's passing an invalid key to
pthread_getspecific. pthread_key_create has not yet been called, so
any possible key is invalid, and produces undefined behavior.
I'll follow up on their tracker ticket.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
