From 29bad49d72e5aeedb97d2bb2af44838d934026a0 Mon Sep 17 00:00:00 2001 From: Rich Felker Date: Wed, 25 Sep 2019 21:49:53 -0400 Subject: fix data race in timer_create with SIGEV_THREAD notification in the timer thread start function, self->timer_id was accessed without synchronization; the timer thread could fail to see the store from the calling thread, resulting in timer_delete failing to delete the correct kernel-level timer. this fix is based on a patch by changdiankang, but with the load moved to after receiving the timer_delete signal rather than just after the start barrier, so as not to retain the possibility of data race with timer_delete. --- src/time/timer_create.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/time/timer_create.c b/src/time/timer_create.c index c5e40a19..455d49fc 100644 --- a/src/time/timer_create.c +++ b/src/time/timer_create.c @@ -1,5 +1,6 @@ #include #include +#include #include "pthread_impl.h" struct ksigevent { @@ -48,7 +49,6 @@ static void *start(void *arg) { pthread_t self = __pthread_self(); struct start_args *args = arg; - int id = self->timer_id; jmp_buf jb; void (*notify)(union sigval) = args->sev->sigev_notify_function; @@ -65,7 +65,7 @@ static void *start(void *arg) } if (self->timer_id < 0) break; } - __syscall(SYS_timer_delete, id); + __syscall(SYS_timer_delete, self->timer_id & INT_MAX); return 0; } -- cgit v1.2.1