[Bug nptl/2644] New: Race condition during unwind code after thread cancellation

["batneil at thebatcave dot org dot uk" <sourceware-bugzilla at sourceware dot org>]

I think there is a race condition in the code in
nptl/sysdeps/pthread/unwind-forcedunwind.c which can lead to a segfault.  I
found this in a redhat build, but it exists in CVS glibc too (as of May 6 2006).

Consider a call to _Unwind_ForcedUnwind, when libgcc_s_forcedunwind has not been
loaded.  _Unwind_ForcedUnwind checks the value against null, and jumps to
pthread_cancel_init.  Meanwhile another thread comes in and initialises all
these pointers, so the first check in pthread_cancel_init shows that
libgcc_s_getcfa is non-null, so we return to _Unwind_ForcedUnwind and execute
libgcc_s_forcedunwind.  As the function pointer libgcc_s_forcedunwind has not
been marked volatile, the compiler does not need to reload this value, and
attempts to call the address it previously loaded, ie. 0.

I have a test case which shows the problem and patch which I believe fixes it.

-- 
           Summary: Race condition during unwind code after thread
                    cancellation
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nptl
        AssignedTo: drepper at redhat dot com
        ReportedBy: batneil at thebatcave dot org dot uk
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: i686-redhat-linux
  GCC host triplet: i686-redhat-linux
GCC target triplet: i686-redhat-linux


http://sourceware.org/bugzilla/show_bug.cgi?id=2644

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.