[08/19] nptl: Use __pthread_attr_copy in pthread_getattr_default_np (bug 25999)

Message ID f4bd12d279f8f49e69cb845b0aac431f97fa6331.1589884403.git.fweimer@redhat.com
State New
Headers show
Series
  • Signal mask for timer helper thread
Related show

Commit Message

Florian Weimer via Libc-alpha May 19, 2020, 10:44 a.m.
pthread_getattr_default_np needs to make a deep copy.
---
 nptl/Makefile                       |  1 +
 nptl/pthread_getattr_default_np.c   | 12 ++---
 nptl/tst-pthread-defaultattr-free.c | 78 +++++++++++++++++++++++++++++
 3 files changed, 82 insertions(+), 9 deletions(-)
 create mode 100644 nptl/tst-pthread-defaultattr-free.c

-- 
2.25.4

Comments

Florian Weimer via Libc-alpha May 20, 2020, 2:42 p.m. | #1
On 5/19/20 6:44 AM, Florian Weimer via Libc-alpha wrote:
> pthread_getattr_default_np needs to make a deep copy.


Agreed, this seems like an oversight regarding the affinity.
I expect not enough programs ever use the kind of setup you run in
the test, but it's still wrong, we should be doing a deep copy.

Tested clean on x86_64 and i686.

OK for master.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>

Tested-by: Carlos O'Donell <carlos@redhat.com>


> ---

>  nptl/Makefile                       |  1 +

>  nptl/pthread_getattr_default_np.c   | 12 ++---

>  nptl/tst-pthread-defaultattr-free.c | 78 +++++++++++++++++++++++++++++

>  3 files changed, 82 insertions(+), 9 deletions(-)

>  create mode 100644 nptl/tst-pthread-defaultattr-free.c

> 

> diff --git a/nptl/Makefile b/nptl/Makefile

> index b4aaad0f20..e5686b20ac 100644

> --- a/nptl/Makefile

> +++ b/nptl/Makefile

> @@ -328,6 +328,7 @@ tests = tst-attr2 tst-attr3 tst-default-attr \

>  	tst-thread-affinity-pthread \

>  	tst-thread-affinity-pthread2 \

>  	tst-thread-affinity-sched \

> +	tst-pthread-defaultattr-free \


OK.

>  

>  

>  tests-container =  tst-pthread-getattr

> diff --git a/nptl/pthread_getattr_default_np.c b/nptl/pthread_getattr_default_np.c

> index cce20cbe94..a9665c5df7 100644

> --- a/nptl/pthread_getattr_default_np.c

> +++ b/nptl/pthread_getattr_default_np.c

> @@ -16,20 +16,14 @@

>     License along with the GNU C Library; if not, see

>     <https://www.gnu.org/licenses/>.  */

>  

> -#include <errno.h>

> -#include <stdlib.h>

>  #include <pthreadP.h>

>  

>  int

>  pthread_getattr_default_np (pthread_attr_t *out)

>  {

> -  struct pthread_attr *real_out;

> -

> -  real_out = (struct pthread_attr *) out;

> -

>    lll_lock (__default_pthread_attr_lock, LLL_PRIVATE);

> -  *real_out = __default_pthread_attr;

> +  int ret = __pthread_attr_copy (out,

> +                                 (pthread_attr_t *) &__default_pthread_attr);


OK. Locks kept in place, and call to __pthread_attr_copy owns the struct.

>    lll_unlock (__default_pthread_attr_lock, LLL_PRIVATE);

> -

> -  return 0;

> +  return ret;

>  }

> diff --git a/nptl/tst-pthread-defaultattr-free.c b/nptl/tst-pthread-defaultattr-free.c

> new file mode 100644

> index 0000000000..5a84302380

> --- /dev/null

> +++ b/nptl/tst-pthread-defaultattr-free.c

> @@ -0,0 +1,78 @@

> +/* Test for user-after-free bug in pthread_getattr_default_np (bug 25999).


OK.

> +   Copyright (C) 2020 Free Software Foundation, Inc.

> +   This file is part of the GNU C Library.

> +

> +   The GNU C Library is free software; you can redistribute it and/or

> +   modify it under the terms of the GNU Lesser General Public

> +   License as published by the Free Software Foundation; either

> +   version 2.1 of the License, or (at your option) any later version.

> +

> +   The GNU C Library is distributed in the hope that it will be useful,

> +   but WITHOUT ANY WARRANTY; without even the implied warranty of

> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

> +   Lesser General Public License for more details.

> +

> +   You should have received a copy of the GNU Lesser General Public

> +   License along with the GNU C Library; if not, see

> +   <https://www.gnu.org/licenses/>.  */

> +

> +#include <pthread.h>

> +#include <sched.h>

> +#include <support/check.h>

> +#include <support/xthread.h>

> +

> +static int

> +do_test (void)

> +{

> +  /* This is a typical affinity size.  */

> +  enum { cpu_count = 128 };

> +  cpu_set_t *set = CPU_ALLOC (cpu_count);

> +  size_t set_size = CPU_ALLOC_SIZE (cpu_count);

> +  CPU_ZERO_S (set_size, set);

> +  CPU_SET (1, set);

> +  CPU_SET (3, set);


OK.

> +

> +  /* Apply the affinity mask to the default attribute.  */

> +  pthread_attr_t attr;

> +  xpthread_attr_init (&attr);

> +  TEST_COMPARE (pthread_attr_setaffinity_np (&attr, set_size, set), 0);

> +  TEST_COMPARE (pthread_setattr_default_np (&attr), 0);


OK. Set the default.

> +  xpthread_attr_destroy (&attr);


OK.

> +

> +  /* Read back the default attribute and check affinity mask.  */

> +  pthread_getattr_default_np (&attr);

> +  CPU_ZERO_S (set_size, set);

> +  TEST_COMPARE (pthread_attr_getaffinity_np (&attr, set_size, set), 0);

> +  for (int i = 0; i < cpu_count; ++i)

> +    TEST_COMPARE (!!CPU_ISSET (i, set), i == 1 || i == 3);


OK.

> +

> +

> +  /* Apply a larger CPU affinity mask to the default attribute, to

> +     trigger reallocation.  */

> +  {

> +    cpu_set_t *large_set = CPU_ALLOC (4 * cpu_count);

> +    size_t large_set_size = CPU_ALLOC_SIZE (4 * cpu_count);

> +    CPU_ZERO_S (large_set_size, large_set);

> +    pthread_attr_t large_attr;

> +    xpthread_attr_init (&large_attr);

> +    TEST_COMPARE (pthread_attr_setaffinity_np (&large_attr,

> +                                               large_set_size, large_set), 0);

> +    TEST_COMPARE (pthread_setattr_default_np (&large_attr), 0);


OK.

> +    xpthread_attr_destroy (&large_attr);

> +    CPU_FREE (large_set);

> +  }

> +

> +  /* Read back the default attribute and check affinity mask.  */

> +  CPU_ZERO_S (set_size, set);

> +  TEST_COMPARE (pthread_attr_getaffinity_np (&attr, set_size, set), 0);

> +  for (int i = 0; i < cpu_count; ++i)

> +    TEST_COMPARE (!!CPU_ISSET (i, set), i == 1 || i == 3);

> +  /* Due to bug 25999, the following caused a double-free abort.  */

> +  xpthread_attr_destroy (&attr);


OK.

> +

> +  CPU_FREE (set);

> +

> +  return 0;

> +}

> +

> +#include <support/test-driver.c>

> 



-- 
Cheers,
Carlos.

Patch

diff --git a/nptl/Makefile b/nptl/Makefile
index b4aaad0f20..e5686b20ac 100644
--- a/nptl/Makefile
+++ b/nptl/Makefile
@@ -328,6 +328,7 @@  tests = tst-attr2 tst-attr3 tst-default-attr \
 	tst-thread-affinity-pthread \
 	tst-thread-affinity-pthread2 \
 	tst-thread-affinity-sched \
+	tst-pthread-defaultattr-free \
 
 
 tests-container =  tst-pthread-getattr
diff --git a/nptl/pthread_getattr_default_np.c b/nptl/pthread_getattr_default_np.c
index cce20cbe94..a9665c5df7 100644
--- a/nptl/pthread_getattr_default_np.c
+++ b/nptl/pthread_getattr_default_np.c
@@ -16,20 +16,14 @@ 
    License along with the GNU C Library; if not, see
    <https://www.gnu.org/licenses/>.  */
 
-#include <errno.h>
-#include <stdlib.h>
 #include <pthreadP.h>
 
 int
 pthread_getattr_default_np (pthread_attr_t *out)
 {
-  struct pthread_attr *real_out;
-
-  real_out = (struct pthread_attr *) out;
-
   lll_lock (__default_pthread_attr_lock, LLL_PRIVATE);
-  *real_out = __default_pthread_attr;
+  int ret = __pthread_attr_copy (out,
+                                 (pthread_attr_t *) &__default_pthread_attr);
   lll_unlock (__default_pthread_attr_lock, LLL_PRIVATE);
-
-  return 0;
+  return ret;
 }
diff --git a/nptl/tst-pthread-defaultattr-free.c b/nptl/tst-pthread-defaultattr-free.c
new file mode 100644
index 0000000000..5a84302380
--- /dev/null
+++ b/nptl/tst-pthread-defaultattr-free.c
@@ -0,0 +1,78 @@ 
+/* Test for user-after-free bug in pthread_getattr_default_np (bug 25999).
+   Copyright (C) 2020 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <pthread.h>
+#include <sched.h>
+#include <support/check.h>
+#include <support/xthread.h>
+
+static int
+do_test (void)
+{
+  /* This is a typical affinity size.  */
+  enum { cpu_count = 128 };
+  cpu_set_t *set = CPU_ALLOC (cpu_count);
+  size_t set_size = CPU_ALLOC_SIZE (cpu_count);
+  CPU_ZERO_S (set_size, set);
+  CPU_SET (1, set);
+  CPU_SET (3, set);
+
+  /* Apply the affinity mask to the default attribute.  */
+  pthread_attr_t attr;
+  xpthread_attr_init (&attr);
+  TEST_COMPARE (pthread_attr_setaffinity_np (&attr, set_size, set), 0);
+  TEST_COMPARE (pthread_setattr_default_np (&attr), 0);
+  xpthread_attr_destroy (&attr);
+
+  /* Read back the default attribute and check affinity mask.  */
+  pthread_getattr_default_np (&attr);
+  CPU_ZERO_S (set_size, set);
+  TEST_COMPARE (pthread_attr_getaffinity_np (&attr, set_size, set), 0);
+  for (int i = 0; i < cpu_count; ++i)
+    TEST_COMPARE (!!CPU_ISSET (i, set), i == 1 || i == 3);
+
+
+  /* Apply a larger CPU affinity mask to the default attribute, to
+     trigger reallocation.  */
+  {
+    cpu_set_t *large_set = CPU_ALLOC (4 * cpu_count);
+    size_t large_set_size = CPU_ALLOC_SIZE (4 * cpu_count);
+    CPU_ZERO_S (large_set_size, large_set);
+    pthread_attr_t large_attr;
+    xpthread_attr_init (&large_attr);
+    TEST_COMPARE (pthread_attr_setaffinity_np (&large_attr,
+                                               large_set_size, large_set), 0);
+    TEST_COMPARE (pthread_setattr_default_np (&large_attr), 0);
+    xpthread_attr_destroy (&large_attr);
+    CPU_FREE (large_set);
+  }
+
+  /* Read back the default attribute and check affinity mask.  */
+  CPU_ZERO_S (set_size, set);
+  TEST_COMPARE (pthread_attr_getaffinity_np (&attr, set_size, set), 0);
+  for (int i = 0; i < cpu_count; ++i)
+    TEST_COMPARE (!!CPU_ISSET (i, set), i == 1 || i == 3);
+  /* Due to bug 25999, the following caused a double-free abort.  */
+  xpthread_attr_destroy (&attr);
+
+  CPU_FREE (set);
+
+  return 0;
+}
+
+#include <support/test-driver.c>