diff options
Diffstat (limited to 'meta-agl-bsp')
| -rw-r--r-- | meta-agl-bsp/meta-core/recipes-core/glibc/files/0028-Bug-20116-Fix-use-after-free-in-pthread_create.patch | 637 | ||||
| -rw-r--r-- | meta-agl-bsp/meta-core/recipes-core/glibc/glibc_2.24.bbappend | 4 |
2 files changed, 0 insertions, 641 deletions
diff --git a/meta-agl-bsp/meta-core/recipes-core/glibc/files/0028-Bug-20116-Fix-use-after-free-in-pthread_create.patch b/meta-agl-bsp/meta-core/recipes-core/glibc/files/0028-Bug-20116-Fix-use-after-free-in-pthread_create.patch deleted file mode 100644 index f06f85c62..000000000 --- a/meta-agl-bsp/meta-core/recipes-core/glibc/files/0028-Bug-20116-Fix-use-after-free-in-pthread_create.patch +++ /dev/null @@ -1,637 +0,0 @@ -From e7ba24f05d86acf7072e066ea6d7b235a106688c Mon Sep 17 00:00:00 2001 -From: Carlos O'Donell <carlos@redhat.com> -Date: Sat, 28 Jan 2017 19:13:34 -0500 -Subject: [PATCH] Bug 20116: Fix use after free in pthread_create() - -The commit documents the ownership rules around 'struct pthread' and -when a thread can read or write to the descriptor. With those ownership -rules in place it becomes obvious that pd->stopped_start should not be -touched in several of the paths during thread startup, particularly so -for detached threads. In the case of detached threads, between the time -the thread is created by the OS kernel and the creating thread checks -pd->stopped_start, the detached thread might have already exited and the -memory for pd unmapped. As a regression test we add a simple test which -exercises this exact case by quickly creating detached threads with -large enough stacks to ensure the thread stack cache is bypassed and the -stacks are unmapped. Before the fix the testcase segfaults, after the -fix it works correctly and completes without issue. - -For a detailed discussion see: -https://www.sourceware.org/ml/libc-alpha/2017-01/msg00505.html - -(cherry-picked from commit f8bf15febcaf137bbec5a61101e88cd5a9d56ca8) - -Upstream-Status: Backport [master] -Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com> ---- - ChangeLog | 23 ++++ - nptl/Makefile | 3 +- - nptl/createthread.c | 10 +- - nptl/pthread_create.c | 207 +++++++++++++++++++++++++++------ - nptl/pthread_getschedparam.c | 1 + - nptl/pthread_setschedparam.c | 1 + - nptl/pthread_setschedprio.c | 1 + - nptl/tpp.c | 2 + - nptl/tst-create-detached.c | 137 ++++++++++++++++++++++ - sysdeps/nacl/createthread.c | 10 +- - sysdeps/unix/sysv/linux/createthread.c | 16 ++- - 11 files changed, 356 insertions(+), 55 deletions(-) - create mode 100644 nptl/tst-create-detached.c - -diff --git a/nptl/Makefile b/nptl/Makefile -index 0d8aadebed..7dec4edb53 100644 ---- a/nptl/Makefile -+++ b/nptl/Makefile -@@ -290,7 +290,8 @@ tests = tst-typesizes \ - tst-initializers1 $(addprefix tst-initializers1-,\ - c89 gnu89 c99 gnu99 c11 gnu11) \ - tst-bad-schedattr \ -- tst-thread_local1 tst-mutex-errorcheck tst-robust10 -+ tst-thread_local1 tst-mutex-errorcheck tst-robust10 \ -+ tst-create-detached \ - xtests = tst-setuid1 tst-setuid1-static tst-setuid2 \ - tst-mutexpp1 tst-mutexpp6 tst-mutexpp10 - test-srcs = tst-oddstacklimit -diff --git a/nptl/createthread.c b/nptl/createthread.c -index ba2f9c7167..328f85865d 100644 ---- a/nptl/createthread.c -+++ b/nptl/createthread.c -@@ -25,16 +25,14 @@ - - static int - create_thread (struct pthread *pd, const struct pthread_attr *attr, -- bool stopped_start, STACK_VARIABLES_PARMS, bool *thread_ran) -+ bool *stopped_start, STACK_VARIABLES_PARMS, bool *thread_ran) - { - /* If the implementation needs to do some tweaks to the thread after - it has been created at the OS level, it can set STOPPED_START here. */ - -- pd->stopped_start = stopped_start; -- if (__glibc_unlikely (stopped_start)) -- /* We make sure the thread does not run far by forcing it to get a -- lock. We lock it here too so that the new thread cannot continue -- until we tell it to. */ -+ pd->stopped_start = *stopped_start; -+ if (__glibc_unlikely (*stopped_start)) -+ /* See CONCURRENCY NOTES in nptl/pthread_create.c. */ - lll_lock (pd->lock, LLL_PRIVATE); - - return ENOSYS; -diff --git a/nptl/pthread_create.c b/nptl/pthread_create.c -index a834063ad5..44b17bec86 100644 ---- a/nptl/pthread_create.c -+++ b/nptl/pthread_create.c -@@ -54,25 +54,141 @@ unsigned int __nptl_nthreads = 1; - /* Code to allocate and deallocate a stack. */ - #include "allocatestack.c" - --/* createthread.c defines this function, and two macros: -+/* CONCURRENCY NOTES: -+ -+ Understanding who is the owner of the 'struct pthread' or 'PD' -+ (refers to the value of the 'struct pthread *pd' function argument) -+ is critically important in determining exactly which operations are -+ allowed and which are not and when, particularly when it comes to the -+ implementation of pthread_create, pthread_join, pthread_detach, and -+ other functions which all operate on PD. -+ -+ The owner of PD is responsible for freeing the final resources -+ associated with PD, and may examine the memory underlying PD at any -+ point in time until it frees it back to the OS or to reuse by the -+ runtime. -+ -+ The thread which calls pthread_create is called the creating thread. -+ The creating thread begins as the owner of PD. -+ -+ During startup the new thread may examine PD in coordination with the -+ owner thread (which may be itself). -+ -+ The four cases of ownership transfer are: -+ -+ (1) Ownership of PD is released to the process (all threads may use it) -+ after the new thread starts in a joinable state -+ i.e. pthread_create returns a usable pthread_t. -+ -+ (2) Ownership of PD is released to the new thread starting in a detached -+ state. -+ -+ (3) Ownership of PD is dynamically released to a running thread via -+ pthread_detach. -+ -+ (4) Ownership of PD is acquired by the thread which calls pthread_join. -+ -+ Implementation notes: -+ -+ The PD->stopped_start and thread_ran variables are used to determine -+ exactly which of the four ownership states we are in and therefore -+ what actions can be taken. For example after (2) we cannot read or -+ write from PD anymore since the thread may no longer exist and the -+ memory may be unmapped. The most complicated cases happen during -+ thread startup: -+ -+ (a) If the created thread is in a detached (PTHREAD_CREATE_DETACHED), -+ or joinable (default PTHREAD_CREATE_JOINABLE) state and -+ STOPPED_START is true, then the creating thread has ownership of -+ PD until the PD->lock is released by pthread_create. If any -+ errors occur we are in states (c), (d), or (e) below. -+ -+ (b) If the created thread is in a detached state -+ (PTHREAD_CREATED_DETACHED), and STOPPED_START is false, then the -+ creating thread has ownership of PD until it invokes the OS -+ kernel's thread creation routine. If this routine returns -+ without error, then the created thread owns PD; otherwise, see -+ (c) and (e) below. -+ -+ (c) If the detached thread setup failed and THREAD_RAN is true, then -+ the creating thread releases ownership to the new thread by -+ sending a cancellation signal. All threads set THREAD_RAN to -+ true as quickly as possible after returning from the OS kernel's -+ thread creation routine. -+ -+ (d) If the joinable thread setup failed and THREAD_RAN is true, then -+ then the creating thread retains ownership of PD and must cleanup -+ state. Ownership cannot be released to the process via the -+ return of pthread_create since a non-zero result entails PD is -+ undefined and therefore cannot be joined to free the resources. -+ We privately call pthread_join on the thread to finish handling -+ the resource shutdown (Or at least we should, see bug 19511). -+ -+ (e) If the thread creation failed and THREAD_RAN is false, then the -+ creating thread retains ownership of PD and must cleanup state. -+ No waiting for the new thread is required because it never -+ started. -+ -+ The nptl_db interface: -+ -+ The interface with nptl_db requires that we enqueue PD into a linked -+ list and then call a function which the debugger will trap. The PD -+ will then be dequeued and control returned to the thread. The caller -+ at the time must have ownership of PD and such ownership remains -+ after control returns to thread. The enqueued PD is removed from the -+ linked list by the nptl_db callback td_thr_event_getmsg. The debugger -+ must ensure that the thread does not resume execution, otherwise -+ ownership of PD may be lost and examining PD will not be possible. -+ -+ Note that the GNU Debugger as of (December 10th 2015) commit -+ c2c2a31fdb228d41ce3db62b268efea04bd39c18 no longer uses -+ td_thr_event_getmsg and several other related nptl_db interfaces. The -+ principal reason for this is that nptl_db does not support non-stop -+ mode where other threads can run concurrently and modify runtime -+ structures currently in use by the debugger and the nptl_db -+ interface. -+ -+ Axioms: -+ -+ * The create_thread function can never set stopped_start to false. -+ * The created thread can read stopped_start but never write to it. -+ * The variable thread_ran is set some time after the OS thread -+ creation routine returns, how much time after the thread is created -+ is unspecified, but it should be as quickly as possible. -+ -+*/ -+ -+/* CREATE THREAD NOTES: -+ -+ createthread.c defines the create_thread function, and two macros: - START_THREAD_DEFN and START_THREAD_SELF (see below). - -- create_thread is obliged to initialize PD->stopped_start. It -- should be true if the STOPPED_START parameter is true, or if -- create_thread needs the new thread to synchronize at startup for -- some other implementation reason. If PD->stopped_start will be -- true, then create_thread is obliged to perform the operation -- "lll_lock (PD->lock, LLL_PRIVATE)" before starting the thread. -+ create_thread must initialize PD->stopped_start. It should be true -+ if the STOPPED_START parameter is true, or if create_thread needs the -+ new thread to synchronize at startup for some other implementation -+ reason. If STOPPED_START will be true, then create_thread is obliged -+ to lock PD->lock before starting the thread. Then pthread_create -+ unlocks PD->lock which synchronizes-with START_THREAD_DEFN in the -+ child thread which does an acquire/release of PD->lock as the last -+ action before calling the user entry point. The goal of all of this -+ is to ensure that the required initial thread attributes are applied -+ (by the creating thread) before the new thread runs user code. Note -+ that the the functions pthread_getschedparam, pthread_setschedparam, -+ pthread_setschedprio, __pthread_tpp_change_priority, and -+ __pthread_current_priority reuse the same lock, PD->lock, for a -+ similar purpose e.g. synchronizing the setting of similar thread -+ attributes. These functions are never called before the thread is -+ created, so don't participate in startup syncronization, but given -+ that the lock is present already and in the unlocked state, reusing -+ it saves space. - - The return value is zero for success or an errno code for failure. - If the return value is ENOMEM, that will be translated to EAGAIN, - so create_thread need not do that. On failure, *THREAD_RAN should - be set to true iff the thread actually started up and then got -- cancelled before calling user code (*PD->start_routine), in which -- case it is responsible for doing its own cleanup. */ -- -+ canceled before calling user code (*PD->start_routine). */ - static int create_thread (struct pthread *pd, const struct pthread_attr *attr, -- bool stopped_start, STACK_VARIABLES_PARMS, -+ bool *stopped_start, STACK_VARIABLES_PARMS, - bool *thread_ran); - - #include <createthread.c> -@@ -314,12 +430,19 @@ START_THREAD_DEFN - /* Store the new cleanup handler info. */ - THREAD_SETMEM (pd, cleanup_jmp_buf, &unwind_buf); - -+ /* We are either in (a) or (b), and in either case we either own -+ PD already (2) or are about to own PD (1), and so our only -+ restriction would be that we can't free PD until we know we -+ have ownership (see CONCURRENCY NOTES above). */ - if (__glibc_unlikely (pd->stopped_start)) - { - int oldtype = CANCEL_ASYNC (); - - /* Get the lock the parent locked to force synchronization. */ - lll_lock (pd->lock, LLL_PRIVATE); -+ -+ /* We have ownership of PD now. */ -+ - /* And give it up right away. */ - lll_unlock (pd->lock, LLL_PRIVATE); - -@@ -378,7 +501,8 @@ START_THREAD_DEFN - pd, pd->nextevent)); - } - -- /* Now call the function to signal the event. */ -+ /* Now call the function which signals the event. See -+ CONCURRENCY NOTES for the nptl_db interface comments. */ - __nptl_death_event (); - } - } -@@ -642,19 +766,28 @@ __pthread_create_2_1 (pthread_t *newthread, const pthread_attr_t *attr, - that cares whether the thread count is correct. */ - atomic_increment (&__nptl_nthreads); - -- bool thread_ran = false; -+ /* Our local value of stopped_start and thread_ran can be accessed at -+ any time. The PD->stopped_start may only be accessed if we have -+ ownership of PD (see CONCURRENCY NOTES above). */ -+ bool stopped_start = false; bool thread_ran = false; - - /* Start the thread. */ - if (__glibc_unlikely (report_thread_creation (pd))) - { -- /* Create the thread. We always create the thread stopped -- so that it does not get far before we tell the debugger. */ -- retval = create_thread (pd, iattr, true, STACK_VARIABLES_ARGS, -- &thread_ran); -+ stopped_start = true; -+ -+ /* We always create the thread stopped at startup so we can -+ notify the debugger. */ -+ retval = create_thread (pd, iattr, &stopped_start, -+ STACK_VARIABLES_ARGS, &thread_ran); - if (retval == 0) - { -- /* create_thread should have set this so that the logic below can -- test it. */ -+ /* We retain ownership of PD until (a) (see CONCURRENCY NOTES -+ above). */ -+ -+ /* Assert stopped_start is true in both our local copy and the -+ PD copy. */ -+ assert (stopped_start); - assert (pd->stopped_start); - - /* Now fill in the information about the new thread in -@@ -671,26 +804,30 @@ __pthread_create_2_1 (pthread_t *newthread, const pthread_attr_t *attr, - pd, pd->nextevent) - != 0); - -- /* Now call the function which signals the event. */ -+ /* Now call the function which signals the event. See -+ CONCURRENCY NOTES for the nptl_db interface comments. */ - __nptl_create_event (); - } - } - else -- retval = create_thread (pd, iattr, false, STACK_VARIABLES_ARGS, -- &thread_ran); -+ retval = create_thread (pd, iattr, &stopped_start, -+ STACK_VARIABLES_ARGS, &thread_ran); - - if (__glibc_unlikely (retval != 0)) - { -- /* If thread creation "failed", that might mean that the thread got -- created and ran a little--short of running user code--but then -- create_thread cancelled it. In that case, the thread will do all -- its own cleanup just like a normal thread exit after a successful -- creation would do. */ -- - if (thread_ran) -- assert (pd->stopped_start); -+ /* State (c) or (d) and we may not have PD ownership (see -+ CONCURRENCY NOTES above). We can assert that STOPPED_START -+ must have been true because thread creation didn't fail, but -+ thread attribute setting did. */ -+ /* See bug 19511 which explains why doing nothing here is a -+ resource leak for a joinable thread. */ -+ assert (stopped_start); - else - { -+ /* State (e) and we have ownership of PD (see CONCURRENCY -+ NOTES above). */ -+ - /* Oops, we lied for a second. */ - atomic_decrement (&__nptl_nthreads); - -@@ -710,10 +847,14 @@ __pthread_create_2_1 (pthread_t *newthread, const pthread_attr_t *attr, - } - else - { -- if (pd->stopped_start) -- /* The thread blocked on this lock either because we're doing TD_CREATE -- event reporting, or for some other reason that create_thread chose. -- Now let it run free. */ -+ /* We don't know if we have PD ownership. Once we check the local -+ stopped_start we'll know if we're in state (a) or (b) (see -+ CONCURRENCY NOTES above). */ -+ if (stopped_start) -+ /* State (a), we own PD. The thread blocked on this lock either -+ because we're doing TD_CREATE event reporting, or for some -+ other reason that create_thread chose. Now let it run -+ free. */ - lll_unlock (pd->lock, LLL_PRIVATE); - - /* We now have for sure more than one thread. The main thread might -diff --git a/nptl/pthread_getschedparam.c b/nptl/pthread_getschedparam.c -index b887881baf..de71171a08 100644 ---- a/nptl/pthread_getschedparam.c -+++ b/nptl/pthread_getschedparam.c -@@ -35,6 +35,7 @@ __pthread_getschedparam (pthread_t threadid, int *policy, - - int result = 0; - -+ /* See CREATE THREAD NOTES in nptl/pthread_create.c. */ - lll_lock (pd->lock, LLL_PRIVATE); - - /* The library is responsible for maintaining the values at all -diff --git a/nptl/pthread_setschedparam.c b/nptl/pthread_setschedparam.c -index dfb52b9dbf..dcb520f1c8 100644 ---- a/nptl/pthread_setschedparam.c -+++ b/nptl/pthread_setschedparam.c -@@ -36,6 +36,7 @@ __pthread_setschedparam (pthread_t threadid, int policy, - - int result = 0; - -+ /* See CREATE THREAD NOTES in nptl/pthread_create.c. */ - lll_lock (pd->lock, LLL_PRIVATE); - - struct sched_param p; -diff --git a/nptl/pthread_setschedprio.c b/nptl/pthread_setschedprio.c -index cefc6481d6..8134b50560 100644 ---- a/nptl/pthread_setschedprio.c -+++ b/nptl/pthread_setschedprio.c -@@ -38,6 +38,7 @@ pthread_setschedprio (pthread_t threadid, int prio) - struct sched_param param; - param.sched_priority = prio; - -+ /* See CREATE THREAD NOTES in nptl/pthread_create.c. */ - lll_lock (pd->lock, LLL_PRIVATE); - - /* If the thread should have higher priority because of some -diff --git a/nptl/tpp.c b/nptl/tpp.c -index e175bf4d53..223bd6bbee 100644 ---- a/nptl/tpp.c -+++ b/nptl/tpp.c -@@ -114,6 +114,7 @@ __pthread_tpp_change_priority (int previous_prio, int new_prio) - if (priomax == newpriomax) - return 0; - -+ /* See CREATE THREAD NOTES in nptl/pthread_create.c. */ - lll_lock (self->lock, LLL_PRIVATE); - - tpp->priomax = newpriomax; -@@ -165,6 +166,7 @@ __pthread_current_priority (void) - - int result = 0; - -+ /* See CREATE THREAD NOTES in nptl/pthread_create.c. */ - lll_lock (self->lock, LLL_PRIVATE); - - if ((self->flags & ATTR_FLAG_SCHED_SET) == 0) -diff --git a/nptl/tst-create-detached.c b/nptl/tst-create-detached.c -new file mode 100644 -index 0000000000..ea93e441c7 ---- /dev/null -+++ b/nptl/tst-create-detached.c -@@ -0,0 +1,137 @@ -+/* Bug 20116: Test rapid creation of detached threads. -+ Copyright (C) 2017 Free Software Foundation, Inc. -+ This file is part of the GNU C Library. -+ -+ The GNU C Library is free software; you can redistribute it and/or -+ modify it under the terms of the GNU Lesser General Public -+ License as published by the Free Software Foundation; either -+ version 2.1 of the License, or (at your option) any later version. -+ -+ The GNU C Library is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ Lesser General Public License for more details. -+ -+ You should have received a copy of the GNU Lesser General Public -+ License along with the GNU C Library; see the file COPYING.LIB. If -+ not, see <http://www.gnu.org/licenses/>. */ -+ -+/* The goal of the test is to trigger a failure if the parent touches -+ any part of the thread descriptor after the detached thread has -+ exited. We test this by creating many detached threads with large -+ stacks. The stacks quickly fill the the stack cache and subsequent -+ threads will start to cause the thread stacks to be immediately -+ unmapped to satisfy the stack cache max. With the stacks being -+ unmapped the parent's read of any part of the thread descriptor will -+ trigger a segfault. That segfault is what we are trying to cause, -+ since any segfault is a defect in the implementation. */ -+ -+#include <pthread.h> -+#include <stdio.h> -+#include <errno.h> -+#include <unistd.h> -+#include <stdbool.h> -+#include <sys/resource.h> -+#include <support/xthread.h> -+ -+/* Number of threads to create. */ -+enum { threads_to_create = 100000 }; -+ -+/* Number of threads which should spawn other threads. */ -+enum { creator_threads = 2 }; -+ -+/* Counter of threads created so far. This is incremented by all the -+ running creator threads. */ -+static unsigned threads_created; -+ -+/* Thread callback which does nothing, so that the thread exits -+ immediatedly. */ -+static void * -+do_nothing (void *arg) -+{ -+ return NULL; -+} -+ -+/* Attribute indicating that the thread should be created in a detached -+ fashion. */ -+static pthread_attr_t detached; -+ -+/* Barrier to synchronize initialization. */ -+static pthread_barrier_t barrier; -+ -+static void * -+creator_thread (void *arg) -+{ -+ int ret; -+ xpthread_barrier_wait (&barrier); -+ -+ while (true) -+ { -+ pthread_t thr; -+ /* Thread creation will fail if the kernel does not free old -+ threads quickly enough, so we do not report errors. */ -+ ret = pthread_create (&thr, &detached, do_nothing, NULL); -+ if (ret == 0 && __atomic_add_fetch (&threads_created, 1, __ATOMIC_SEQ_CST) -+ >= threads_to_create) -+ break; -+ } -+ -+ return NULL; -+} -+ -+static int -+do_test (void) -+{ -+ /* Limit the size of the process, so that memory allocation will -+ fail without impacting the entire system. */ -+ { -+ struct rlimit limit; -+ if (getrlimit (RLIMIT_AS, &limit) != 0) -+ { -+ printf ("FAIL: getrlimit (RLIMIT_AS) failed: %m\n"); -+ return 1; -+ } -+ /* This limit, 800MB, is just a heuristic. Any value can be -+ picked. */ -+ long target = 800 * 1024 * 1024; -+ if (limit.rlim_cur == RLIM_INFINITY || limit.rlim_cur > target) -+ { -+ limit.rlim_cur = target; -+ if (setrlimit (RLIMIT_AS, &limit) != 0) -+ { -+ printf ("FAIL: setrlimit (RLIMIT_AS) failed: %m\n"); -+ return 1; -+ } -+ } -+ } -+ -+ xpthread_attr_init (&detached); -+ -+ xpthread_attr_setdetachstate (&detached, PTHREAD_CREATE_DETACHED); -+ -+ /* A large thread stack seems beneficial for reproducing a race -+ condition in detached thread creation. The goal is to reach the -+ limit of the runtime thread stack cache such that the detached -+ thread's stack is unmapped after exit and causes a segfault when -+ the parent reads the thread descriptor data stored on the the -+ unmapped stack. */ -+ xpthread_attr_setstacksize (&detached, 16 * 1024 * 1024); -+ -+ xpthread_barrier_init (&barrier, NULL, creator_threads); -+ -+ pthread_t threads[creator_threads]; -+ -+ for (int i = 0; i < creator_threads; ++i) -+ threads[i] = xpthread_create (NULL, creator_thread, NULL); -+ -+ for (int i = 0; i < creator_threads; ++i) -+ xpthread_join (threads[i]); -+ -+ xpthread_attr_destroy (&detached); -+ -+ xpthread_barrier_destroy (&barrier); -+ -+ return 0; -+} -+ -+#include <support/test-driver.c> -diff --git a/sysdeps/nacl/createthread.c b/sysdeps/nacl/createthread.c -index 7b571c34e2..5465558cc1 100644 ---- a/sysdeps/nacl/createthread.c -+++ b/sysdeps/nacl/createthread.c -@@ -32,15 +32,13 @@ static void start_thread (void) __attribute__ ((noreturn)); - - static int - create_thread (struct pthread *pd, const struct pthread_attr *attr, -- bool stopped_start, STACK_VARIABLES_PARMS, bool *thread_ran) -+ bool *stopped_start, STACK_VARIABLES_PARMS, bool *thread_ran) - { - pd->tid = __nacl_get_tid (pd); - -- pd->stopped_start = stopped_start; -- if (__glibc_unlikely (stopped_start)) -- /* We make sure the thread does not run far by forcing it to get a -- lock. We lock it here too so that the new thread cannot continue -- until we tell it to. */ -+ pd->stopped_start = *stopped_start; -+ if (__glibc_unlikely (*stopped_start)) -+ /* See CONCURRENCY NOTES in nptl/pthread_create.c. */ - lll_lock (pd->lock, LLL_PRIVATE); - - TLS_DEFINE_INIT_TP (tp, pd); -diff --git a/sysdeps/unix/sysv/linux/createthread.c b/sysdeps/unix/sysv/linux/createthread.c -index 6d32cece48..66ddae61d4 100644 ---- a/sysdeps/unix/sysv/linux/createthread.c -+++ b/sysdeps/unix/sysv/linux/createthread.c -@@ -46,7 +46,7 @@ static int start_thread (void *arg) __attribute__ ((noreturn)); - - static int - create_thread (struct pthread *pd, const struct pthread_attr *attr, -- bool stopped_start, STACK_VARIABLES_PARMS, bool *thread_ran) -+ bool *stopped_start, STACK_VARIABLES_PARMS, bool *thread_ran) - { - /* Determine whether the newly created threads has to be started - stopped since we have to set the scheduling parameters or set the -@@ -54,13 +54,11 @@ create_thread (struct pthread *pd, const struct pthread_attr *attr, - if (attr != NULL - && (__glibc_unlikely (attr->cpuset != NULL) - || __glibc_unlikely ((attr->flags & ATTR_FLAG_NOTINHERITSCHED) != 0))) -- stopped_start = true; -+ *stopped_start = true; - -- pd->stopped_start = stopped_start; -- if (__glibc_unlikely (stopped_start)) -- /* We make sure the thread does not run far by forcing it to get a -- lock. We lock it here too so that the new thread cannot continue -- until we tell it to. */ -+ pd->stopped_start = *stopped_start; -+ if (__glibc_unlikely (*stopped_start)) -+ /* See CONCURRENCY NOTES in nptl/pthread_creat.c. */ - lll_lock (pd->lock, LLL_PRIVATE); - - /* We rely heavily on various flags the CLONE function understands: -@@ -117,7 +115,7 @@ create_thread (struct pthread *pd, const struct pthread_attr *attr, - /* Set the affinity mask if necessary. */ - if (attr->cpuset != NULL) - { -- assert (stopped_start); -+ assert (*stopped_start); - - res = INTERNAL_SYSCALL (sched_setaffinity, err, 3, pd->tid, - attr->cpusetsize, attr->cpuset); -@@ -140,7 +138,7 @@ create_thread (struct pthread *pd, const struct pthread_attr *attr, - /* Set the scheduling parameters. */ - if ((attr->flags & ATTR_FLAG_NOTINHERITSCHED) != 0) - { -- assert (stopped_start); -+ assert (*stopped_start); - - res = INTERNAL_SYSCALL (sched_setscheduler, err, 3, pd->tid, - pd->schedpolicy, &pd->schedparam); --- -2.11.0 - diff --git a/meta-agl-bsp/meta-core/recipes-core/glibc/glibc_2.24.bbappend b/meta-agl-bsp/meta-core/recipes-core/glibc/glibc_2.24.bbappend deleted file mode 100644 index a9f2a238d..000000000 --- a/meta-agl-bsp/meta-core/recipes-core/glibc/glibc_2.24.bbappend +++ /dev/null @@ -1,4 +0,0 @@ -FILESEXTRAPATHS_prepend := "${THISDIR}/files:" - -# include fix for CVE-2017-1000366 -SRCREV = "86ac4a78a9218d1e1dcfbacc6f7d09957c1fe3a4"
\ No newline at end of file |