From dc3566067ad92394cc301bb6f8fa394ace2949a9 Mon Sep 17 00:00:00 2001 From: John Baldwin Date: Wed, 21 Mar 2018 21:13:26 +0000 Subject: [PATCH] Ensure thread library is initialized in pthread_testcancel(). Call _thr_check_init() before reading curthread in pthread_testcancel(). If a constructor in a library creates a semaphore via sem_init() and then waits for it via sem_wait(), the program can core dump in _pthread_testcancel() called from sem_wait(). This is because the semaphore implementation lives in libc, so the library's constructors can be run before libthr's constructors. Reported by: arichardson Reviewed by: kib Obtained from: CheriBSD MFC after: 1 week Sponsored by: DARPA / AFRL Differential Revision: https://reviews.freebsd.org/D14786 --- lib/libthr/thread/thr_cancel.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/libthr/thread/thr_cancel.c b/lib/libthr/thread/thr_cancel.c index 0f131497aac5..fdcdb2c1051f 100644 --- a/lib/libthr/thread/thr_cancel.c +++ b/lib/libthr/thread/thr_cancel.c @@ -132,8 +132,10 @@ _pthread_setcanceltype(int type, int *oldtype) void _pthread_testcancel(void) { - struct pthread *curthread = _get_curthread(); + struct pthread *curthread; + _thr_check_init(); + curthread = _get_curthread(); testcancel(curthread); }