Page MenuHomeFreeBSD

Fix libthr segfault.
AbandonedPublic

Authored by mmokhi on Apr 25 2016, 3:40 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, May 7, 1:06 PM
Unknown Object (File)
Jan 24 2024, 8:40 PM
Unknown Object (File)
Jan 3 2024, 12:57 PM
Unknown Object (File)
Dec 25 2023, 3:22 AM
Unknown Object (File)
Nov 6 2023, 9:30 PM
Unknown Object (File)
Oct 11 2023, 1:10 PM
Unknown Object (File)
Aug 16 2023, 3:48 PM
Unknown Object (File)
Jul 14 2023, 10:38 PM

Details

Reviewers
kib
Summary

Using pthread_workqueue and libthr, locking/unlockig mutex results in segfault (null-deref.), due adding node to NULL tailq.
This fixes it

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

mmokhi retitled this revision from to Fix libthr segfault..
mmokhi updated this object.
mmokhi edited the test plan for this revision. (Show Details)
mmokhi set the repository for this revision to rS FreeBSD src repository - subversion.

This seems wrong to me. TAILQ_INSERT_TAIL should do the right thing on empty lists. If it doesn't already, that's where the fix should go, I think.

In D6087#129590, @cem wrote:

This seems wrong to me. TAILQ_INSERT_TAIL should do the right thing on empty lists. If it doesn't already, that's where the fix should go, I think.

TAILQ_INSERT_TAIL handles empty queues just fine.

If the fault is real, the debugging data, i.e. at least the backtrace (from libthr compiled with -g) and dump of the curthread content are due.

In D6087#129590, @cem wrote:

This seems wrong to me. TAILQ_INSERT_TAIL should do the right thing on empty lists.

I personally expected that from TAILQ_INSERT_TAIL, but as far as i followed it, it's doing *(head)->tqh_last = (elm);
which assumes tqh_last != NULL without no clear reason.

Maybe we should do something for TAILQ_INSERT_TAIL, but till then this seems fixes it.

In D6087#129593, @kib wrote:
In D6087#129590, @cem wrote:

This seems wrong to me. TAILQ_INSERT_TAIL should do the right thing on empty lists. If it doesn't already, that's where the fix should go, I think.

TAILQ_INSERT_TAIL handles empty queues just fine.

If the fault is real, the debugging data, i.e. at least the backtrace (from libthr compiled with -g) and dump of the curthread content are due.

I should attach dumps here ?
Or in bugzilla ?

In D6087#129593, @kib wrote:
In D6087#129590, @cem wrote:

This seems wrong to me. TAILQ_INSERT_TAIL should do the right thing on empty lists. If it doesn't already, that's where the fix should go, I think.

TAILQ_INSERT_TAIL handles empty queues just fine.

If the fault is real, the debugging data, i.e. at least the backtrace (from libthr compiled with -g) and dump of the curthread content are due.

bugzilla issue : https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209036

In D6087#129603, @mokhi64_gmail.com wrote:
In D6087#129590, @cem wrote:

This seems wrong to me. TAILQ_INSERT_TAIL should do the right thing on empty lists.

I personally expected that from TAILQ_INSERT_TAIL, but as far as i followed it, it's doing *(head)->tqh_last = (elm);
which assumes tqh_last != NULL without no clear reason.

tqh_last is not NULL for initialized tailq.

Maybe we should do something for TAILQ_INSERT_TAIL, but till then this seems fixes it.

In D6087#129620, @kib wrote:
In D6087#129603, @mokhi64_gmail.com wrote:
In D6087#129590, @cem wrote:

This seems wrong to me. TAILQ_INSERT_TAIL should do the right thing on empty lists.

I personally expected that from TAILQ_INSERT_TAIL, but as far as i followed it, it's doing *(head)->tqh_last = (elm);
which assumes tqh_last != NULL without no clear reason.

tqh_last is not NULL for initialized tailq.

Maybe we should do something for TAILQ_INSERT_TAIL, but till then this seems fixes it.

Yes :) you are right.
I think we can delete this review.
Though i think it's a good feature for TAILQ_INSERT_TAIL to check for empty conditions too ;)