[Bug nptl/3086] New: when run tst-timer on x86_64, it causes a segfault

["huangjq at cn dot ibm dot com" <sourceware-bugzilla at sourceware dot org>]

when build tst-timer to 64-bit and run it, it will casues a segfault:
# ./tst-timer
clock_gettime returned 0, timespec = { 1155266976, 602521000 }
clock_getres returned 0, timespec = { 0, 4000250 }
signal_func
notify_func2
signal_func
notify_func2
notify_func1
signal_func
notify_func1
notify_func2
notify_func1
notify_func2
signal_func
notify_func1
notify_func1
notify_func2
signal_func
notify_func1
notify_func2
notify_func1
signal_func
notify_func1
notify_func2
notify_func1
notify_func2
signal_func
notify_func1
notify_func1
notify_func2
signal_func
notify_func1
notify_func2
notify_func1
signal_func
notify_func1
notify_func2
notify_func1
notify_func2
signal_func
notify_func1
notify_func1
notify_func2
signal_func
notify_func1
notify_func2
notify_func1
signal_func
notify_func1
notify_func2
notify_func1
notify_func2
signal_func
notify_func1
notify_func1
notify_func2
signal_func
notify_func1
notify_func2
notify_func1
signal_func
Segmentation fault

# dmesg 
tst-timer[6147]: segfault at 0000000000000000 rip 00002b8eaec8e9f0 rsp 
0000000040804128 error 6

this statement means the process 6147 try to write to address 0000000000000000 
at user-mode.

The root cause is this problem: when one thread try to access a block of 
memory, but very unfortunately, this block of memory is freed by another 
thread. from the execution path of the 64-bit program, we can see there is no 
mutex mechanism to protect this critical section.

Totally, there are two timer_delete.c's and each includes a implementation of 
timer_delete function in glibc:
./nptl/sysdeps/pthread/timer_delete.c
./nptl/sysdeps/unix/sysv/linux/timer_delete.c
if the syscall timer_delete is not available, it will call the timer_delete 
function in the first one, else it will call to the next one, currently, the 
syscall timer_delete is implemented by the kernel. A very important difference 
between the two implementations of timer_delete is the first one has a pthread 
mutex lock, I don't know why this lock is removed in the next version, it 
seems we still need a mutex mechanism to protect the critical section.

-- 
           Summary: when run tst-timer on x86_64, it causes a segfault
           Product: glibc
           Version: 2.4
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nptl
        AssignedTo: drepper at redhat dot com
        ReportedBy: huangjq at cn dot ibm dot com
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=3086

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.