From mboxrd@z Thu Jan  1 00:00:00 1970
X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/14225
Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail
From: Rich Felker <dalias@libc.org>
Newsgroups: gmane.linux.lib.musl.general
Subject: Re: [proposal] Add detection of thread ID in pthread-related
 interfaces
Date: Tue, 11 Jun 2019 12:09:31 -0400
Message-ID: <20190611160931.GD1506@brightrain.aerifal.cx>
References: <4CF320752F2B99449115298D4A06B22F34E3DD31@dggemm509-mbx.china.huawei.com>
Reply-To: musl@lists.openwall.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226";
	logging-data="88029"; mail-complaints-to="usenet@blaine.gmane.org"
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: "musl@lists.openwall.com" <musl@lists.openwall.com>,
	helitao <helitao@huawei.com>,
	"Huangqiang (H)" <h.huangqiang@huawei.com>,
	Jinyongming <jinyongming@huawei.com>,
	leijitang <leijitang@huawei.com>,
	"liuyutao (C)" <liuyutao2@huawei.com>,
	"Liyu (Marvin, Euler Dept)" <marvin.tms@huawei.com>,
	"Threefifteen Wang(Kunfeng)" <threefifteen.wangkunfeng@huawei.com>,
	"Wudilong (Michael)" <wudilong@huawei.com>
To: pengyuanhong <pengyuanhong@huawei.com>
Original-X-From: musl-return-14241-gllmg-musl=m.gmane.org@lists.openwall.com Tue Jun 11 18:12:02 2019
Return-path: <musl-return-14241-gllmg-musl=m.gmane.org@lists.openwall.com>
Envelope-to: gllmg-musl@m.gmane.org
Original-Received: from mother.openwall.net ([195.42.179.200])
	by blaine.gmane.org with smtp (Exim 4.89)
	(envelope-from <musl-return-14241-gllmg-musl=m.gmane.org@lists.openwall.com>)
	id 1hajNS-000Mnl-4L
	for gllmg-musl@m.gmane.org; Tue, 11 Jun 2019 18:12:02 +0200
Original-Received: (qmail 8140 invoked by uid 550); 11 Jun 2019 16:11:59 -0000
Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm
Precedence: bulk
List-Post: <mailto:musl@lists.openwall.com>
List-Help: <mailto:musl-help@lists.openwall.com>
List-Unsubscribe: <mailto:musl-unsubscribe@lists.openwall.com>
List-Subscribe: <mailto:musl-subscribe@lists.openwall.com>
List-ID: <musl.lists.openwall.com>
Original-Received: (qmail 8111 invoked from network); 11 Jun 2019 16:11:59 -0000
Content-Disposition: inline
In-Reply-To: <4CF320752F2B99449115298D4A06B22F34E3DD31@dggemm509-mbx.china.huawei.com>
Original-Sender: Rich Felker <dalias@aerifal.cx>
Xref: news.gmane.org gmane.linux.lib.musl.general:14225
Archived-At: <http://permalink.gmane.org/gmane.linux.lib.musl.general/14225>

On Tue, Jun 11, 2019 at 11:36:59AM +0000, pengyuanhong wrote:
> Hello,
> 
> I find that all pthread-related interfaces directly access the input
> parameter `pthread_t` without any check. If I pass an invalid thread ID
> (e.g. an exited thread ID) to these interfaces, then segment fault
> happens.
> 
> Both glibc and freebsd can do simple detection of thread ID(pthread_t)
> passed by user and return ESRCH when no thread can be found. They
> put all threads in a list or hash table, and update this list or table every
> time a thread is created or exits.

This description of why glibc returns ESRCH is incorrect; it has
nothing to do with keeping a list, which would require >O(1) lookup
and global synchronization on each operation referring to a thread id.
Rather, they just don't free exited threads, but keep the memory
cached to reuse for future calls to pthread_create with a marker that
it's not currently live. This allows trivial detection and reporting
that the id is not currently valid, but also encourages rapid reuse of
the same ids that were just freed, making use-after-free bugs with
pthread_t's much more dangerous.

Rich