]> xenbits.xensource.com Git - unikraft/libs/pthread-embedded.git/commit
Fix use-after-free in glue code for pthread_join RELEASE-0.10.0 RELEASE-0.12.0 RELEASE-0.8.0 RELEASE-0.9.0
authorMarc Rittinghaus <marc.rittinghaus@kit.edu>
Thu, 27 Jan 2022 10:07:58 +0000 (11:07 +0100)
committerUnikraft <monkey@unikraft.io>
Wed, 16 Feb 2022 11:28:23 +0000 (11:28 +0000)
commite2705f98bcb17f423547c2394cc672a52de3d1e4
tree9247b99d6f82cee7de9cf672d2ac4f6c0e29fab5
parenta7fe8c3d0a47fbad6e4e7d6d1c7d7a8f9042f0c1
Fix use-after-free in glue code for pthread_join

When pthread_join is called, we use uk_thread_wait to wait for the
thread to exit. However, this will also release the thread and the
metadata for the pthread in the glue code. pthread_join then calls
pthread_detach, which attempts another wait, accessing the freed
thread.

The commit changes the pte_osThreadHandle to point to the
metadata in the glue code instead of the thread itself and prevents
the metadata from being released on exit of the uk thread. This way,
pthread_detach can detect that the thread has already been released.
Metadata is freed in pte_osThreadDelete (would have caused a double
free before the patch).

Signed-off-by: Marc Rittinghaus <marc.rittinghaus@kit.edu>
Reviewed-by: Vlad-Andrei <vlad_andrei.badoiu@upb.ro>
Approved-by: Simon Kuenzer <simon@unikraft.org>
Tested-by: Unikraft CI <monkey@unikraft.io>
GitHub-Pull-Request: #2
include/pte_osal.h
pte_osal.c