From patchwork Tue May 19 10:44:31 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 39305 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 6CB1E395442E; Tue, 19 May 2020 10:44:39 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 6CB1E395442E DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1589885079; bh=pThNPqEnI6KhC2VT1yayPt+JrEdY2svySd3pBH9zKCI=; h=To:Subject:In-Reply-To:References:Date:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To: From; b=PoVnktdRSLu/mOYcKuOEoWLcblFCIsSAwMdxpiJB+TF8+YEVPXrEzWd5THwDVnDNH ++0+BQTQLRdIWZsoaNCp2g14QPZUoEmvzO7G81pUHlAKNalLa6yi94F0LmpgZBbiSt hvVKIPJIWEEUt1pTqO/OdVaHCNha2NMPQJFYcbCI= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-delivery-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) by sourceware.org (Postfix) with ESMTP id 3C6413948829 for ; Tue, 19 May 2020 10:44:37 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 3C6413948829 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-256-6ZbH7CHZM-ScojJf0KElyw-1; Tue, 19 May 2020 06:44:34 -0400 X-MC-Unique: 6ZbH7CHZM-ScojJf0KElyw-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 74463107ACF2 for ; Tue, 19 May 2020 10:44:33 +0000 (UTC) Received: from oldenburg2.str.redhat.com (ovpn-113-18.ams2.redhat.com [10.36.113.18]) by smtp.corp.redhat.com (Postfix) with ESMTPS id C4CAD82A1C for ; Tue, 19 May 2020 10:44:32 +0000 (UTC) To: libc-alpha@sourceware.org Subject: [PATCH 08/19] nptl: Use __pthread_attr_copy in pthread_getattr_default_np (bug 25999) In-Reply-To: References: Message-Id: Date: Tue, 19 May 2020 12:44:31 +0200 User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-14.0 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, KAM_SHORT, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Florian Weimer via Libc-alpha From: Florian Weimer Reply-To: Florian Weimer Errors-To: libc-alpha-bounces@sourceware.org Sender: "Libc-alpha" pthread_getattr_default_np needs to make a deep copy. Reviewed-by: Carlos O'Donell Tested-by: Carlos O'Donell --- nptl/Makefile | 1 + nptl/pthread_getattr_default_np.c | 12 ++--- nptl/tst-pthread-defaultattr-free.c | 78 +++++++++++++++++++++++++++++ 3 files changed, 82 insertions(+), 9 deletions(-) create mode 100644 nptl/tst-pthread-defaultattr-free.c diff --git a/nptl/Makefile b/nptl/Makefile index b4aaad0f20..e5686b20ac 100644 --- a/nptl/Makefile +++ b/nptl/Makefile @@ -328,6 +328,7 @@ tests = tst-attr2 tst-attr3 tst-default-attr \ tst-thread-affinity-pthread \ tst-thread-affinity-pthread2 \ tst-thread-affinity-sched \ + tst-pthread-defaultattr-free \ tests-container = tst-pthread-getattr diff --git a/nptl/pthread_getattr_default_np.c b/nptl/pthread_getattr_default_np.c index cce20cbe94..a9665c5df7 100644 --- a/nptl/pthread_getattr_default_np.c +++ b/nptl/pthread_getattr_default_np.c @@ -16,20 +16,14 @@ License along with the GNU C Library; if not, see . */ -#include -#include #include int pthread_getattr_default_np (pthread_attr_t *out) { - struct pthread_attr *real_out; - - real_out = (struct pthread_attr *) out; - lll_lock (__default_pthread_attr_lock, LLL_PRIVATE); - *real_out = __default_pthread_attr; + int ret = __pthread_attr_copy (out, + (pthread_attr_t *) &__default_pthread_attr); lll_unlock (__default_pthread_attr_lock, LLL_PRIVATE); - - return 0; + return ret; } diff --git a/nptl/tst-pthread-defaultattr-free.c b/nptl/tst-pthread-defaultattr-free.c new file mode 100644 index 0000000000..5a84302380 --- /dev/null +++ b/nptl/tst-pthread-defaultattr-free.c @@ -0,0 +1,78 @@ +/* Test for user-after-free bug in pthread_getattr_default_np (bug 25999). + Copyright (C) 2020 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include + +static int +do_test (void) +{ + /* This is a typical affinity size. */ + enum { cpu_count = 128 }; + cpu_set_t *set = CPU_ALLOC (cpu_count); + size_t set_size = CPU_ALLOC_SIZE (cpu_count); + CPU_ZERO_S (set_size, set); + CPU_SET (1, set); + CPU_SET (3, set); + + /* Apply the affinity mask to the default attribute. */ + pthread_attr_t attr; + xpthread_attr_init (&attr); + TEST_COMPARE (pthread_attr_setaffinity_np (&attr, set_size, set), 0); + TEST_COMPARE (pthread_setattr_default_np (&attr), 0); + xpthread_attr_destroy (&attr); + + /* Read back the default attribute and check affinity mask. */ + pthread_getattr_default_np (&attr); + CPU_ZERO_S (set_size, set); + TEST_COMPARE (pthread_attr_getaffinity_np (&attr, set_size, set), 0); + for (int i = 0; i < cpu_count; ++i) + TEST_COMPARE (!!CPU_ISSET (i, set), i == 1 || i == 3); + + + /* Apply a larger CPU affinity mask to the default attribute, to + trigger reallocation. */ + { + cpu_set_t *large_set = CPU_ALLOC (4 * cpu_count); + size_t large_set_size = CPU_ALLOC_SIZE (4 * cpu_count); + CPU_ZERO_S (large_set_size, large_set); + pthread_attr_t large_attr; + xpthread_attr_init (&large_attr); + TEST_COMPARE (pthread_attr_setaffinity_np (&large_attr, + large_set_size, large_set), 0); + TEST_COMPARE (pthread_setattr_default_np (&large_attr), 0); + xpthread_attr_destroy (&large_attr); + CPU_FREE (large_set); + } + + /* Read back the default attribute and check affinity mask. */ + CPU_ZERO_S (set_size, set); + TEST_COMPARE (pthread_attr_getaffinity_np (&attr, set_size, set), 0); + for (int i = 0; i < cpu_count; ++i) + TEST_COMPARE (!!CPU_ISSET (i, set), i == 1 || i == 3); + /* Due to bug 25999, the following caused a double-free abort. */ + xpthread_attr_destroy (&attr); + + CPU_FREE (set); + + return 0; +} + +#include