Page MenuHomeFreeBSD

libthr: pthread_query_np(3) and pthread_query_list_np(3)
Needs ReviewPublic

Authored by kib on Sun, Oct 18, 11:25 AM.
Tags
None
Referenced Files
F176567824: D60838.id190259.diff
Mon, Oct 19, 10:03 PM
F176532597: D60838.id190259.diff
Mon, Oct 19, 3:05 PM
Unknown Object (File)
Mon, Oct 19, 5:10 AM
Unknown Object (File)
Mon, Oct 19, 3:39 AM
Unknown Object (File)
Mon, Oct 19, 3:36 AM
Unknown Object (File)
Mon, Oct 19, 1:00 AM
Unknown Object (File)
Sun, Oct 18, 10:59 PM
Unknown Object (File)
Sun, Oct 18, 10:17 PM
Subscribers

Details

Reviewers
markj
aokblast
Summary

Also:

libthr: fix the race between pthread_getname_np() and thread exit

The exiting thread frees the thread name in exit_thread() without
holding the thread lock.  This makes it possible for a thread doing
pthread_getname_np() to observe the non-null thread->name and try to
copy its content, accessing the memory after free.

Set the thread->name to NULL under the thread lock.  Note that other
thread might still set the exiting thread name, until the PS_DEAD state
is assigned.  Since code should not call free() after
_malloc_thread_cleanup(), re-check thread->name in _thr_free().

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

kib requested review of this revision.Sun, Oct 18, 11:25 AM

Man page and test will be done after discussion.

Do not expose internal pointer to the thread name.

lib/libthr/thread/thr_query.c
23

Don't we need to fill rsrv fields to 0 so that if it is chaged in the future, the ABI still see previous value as 0 instead of random value.

53

Isn't it also a internal pointer?

101

What if a thread exit in the middle that decrease _thread_active_threads but before thread is GCed?

kib marked 3 inline comments as done.Mon, Oct 19, 8:56 AM
kib added inline comments.
lib/libthr/thread/thr_query.c
53

Almost all of the info I return is 'internal'. This does not make it less useful for debugging/exploration purposes.
FWIW, TCB address is available as *(thread_pointer)->0 by ABI, and several language runtimes depend on it.

101

So what? This is race, and caller has to cope with the race of the count changing.
I do not allocate memory for the buffer, it is the duty of the caller. The only correctness guarantee that the library must provide there is that it does not write outside the buffer, and reports when buffer was too small for the specific call.

kib marked 2 inline comments as done.

Zero reserved fields of the info structure.

kib edited the summary of this revision. (Show Details)

Rework API.
Add man page.
Fix pre-existing race also affecting the patch.

Add copyright statement to the man page.