From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 23294 invoked from network); 12 Jul 2023 02:48:19 -0000 Received: from second.openwall.net (193.110.157.125) by inbox.vuxu.org with ESMTPUTF8; 12 Jul 2023 02:48:19 -0000 Received: (qmail 22220 invoked by uid 550); 12 Jul 2023 02:48:16 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 22185 invoked from network); 12 Jul 2023 02:48:15 -0000 Date: Tue, 11 Jul 2023 22:48:04 -0400 From: Rich Felker To: "Appelmans, Madeleine" Cc: "musl@lists.openwall.com" Message-ID: <20230712024804.GH4163@brightrain.aerifal.cx> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [musl] Difference in pthread behavior between glibc and musl On Tue, Jul 11, 2023 at 07:19:50PM +0000, Appelmans, Madeleine wrote: > Hello, > > There seems to be a difference in pthread behavior when compiling > with glibc and using the musl-gcc wrapper. The attached snippet of > code creates a destructor attribute which deletes a pthread key. The > code never actually creates the pthread key. This code segfaults > when compiled using musl-gcc, and does not segfault when compiled > with gcc. > > Best guess at what is going on: When creating a pthread key, musl > initializes a field called > tsd. > When deleting a key, musl assumes that initialization has been done, > and dereferences tsd without checking that it exists: see > here. > This dereference may be the source of the segfault. This is completely expected; the behavior is undefined because you passed to pthread_key_delete a value which was not acquired via pthread_key_create. If it happens not to crash on glibc, that doesn't mean it's okay to do it. It will end up deleting whatever key happens to correspond to the zero-initialized pthread_key_t object, which may be a key that was allocated for use by some other part of the program when it called pthread_key_create. (In other words, you have a type of double-free or use-after-free bug.) Your program logic must ensure you refrain from doing that. Rich