• Mikulas Patocka's avatar
    alpha: fix crash if pthread_create races with signal delivery · f6d7ea7a
    Mikulas Patocka authored
    commit 21ffceda upstream.
    
    On alpha, a process will crash if it attempts to start a thread and a
    signal is delivered at the same time. The crash can be reproduced with
    this program: https://cygwin.com/ml/cygwin/2014-11/msg00473.html
    
    The reason for the crash is this:
    * we call the clone syscall
    * we go to the function copy_process
    * copy process calls copy_thread_tls, it is a wrapper around copy_thread
    * copy_thread sets the tls pointer: childti->pcb.unique = regs->r20
    * copy_thread sets regs->r20 to zero
    * we go back to copy_process
    * copy process checks "if (signal_pending(current))" and returns
      -ERESTARTNOINTR
    * the clone syscall is restarted, but this time, regs->r20 is zero, so
      the new thread is created with zero tls pointer
    * the new thread crashes in start_thread when attempting to access tls
    
    The comment in the code says that setting the register r20 is some
    compatibility with OSF/1. But OSF/1 doesn't use the CLONE_SETTLS flag, so
    we don't have to zero r20 if CLONE_SETTLS is set. This patch fixes the bug
    by zeroing regs->r20 only if CLONE_SETTLS is not set.
    Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: default avatarMatt Turner <mattst88@gmail.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    f6d7ea7a
process.c 9.76 KB