Re: [proposal] Add detection of thread ID in pthread-related interfaces

[Rich Felker <dalias@libc.org>]

On Tue, Jun 11, 2019 at 11:36:59AM +0000, pengyuanhong wrote:
> Hello,
> 
> I find that all pthread-related interfaces directly access the input
> parameter `pthread_t` without any check. If I pass an invalid thread ID
> (e.g. an exited thread ID) to these interfaces, then segment fault
> happens.
> 
> Both glibc and freebsd can do simple detection of thread ID(pthread_t)
> passed by user and return ESRCH when no thread can be found. They
> put all threads in a list or hash table, and update this list or table every
> time a thread is created or exits.

This description of why glibc returns ESRCH is incorrect; it has
nothing to do with keeping a list, which would require >O(1) lookup
and global synchronization on each operation referring to a thread id.
Rather, they just don't free exited threads, but keep the memory
cached to reuse for future calls to pthread_create with a marker that
it's not currently live. This allows trivial detection and reporting
that the id is not currently valid, but also encourages rapid reuse of
the same ids that were just freed, making use-after-free bugs with
pthread_t's much more dangerous.

Rich