kanarip / rpms / glibc

Forked from rpms/glibc 5 years ago
Clone
Blob Blame History Raw
Fix a user-after-free bug in the Systemtap probe in
__pthread_timedjoin_ex:

      /* Free the TCB.  */
      __free_tcb (pd);
    }
  else
    pd->joinid = NULL;

  LIBC_PROBE (pthread_join_ret, 3, threadid, result, pd->result);

__free_tcb has freed the stack, the access pd->result is invalid.

diff --git a/nptl/pthread_join_common.c b/nptl/pthread_join_common.c
index ecb78ffba5861bdc..45deba6a74c5efd2 100644
--- a/nptl/pthread_join_common.c
+++ b/nptl/pthread_join_common.c
@@ -101,7 +101,7 @@ __pthread_timedjoin_ex (pthread_t threadid, void **thread_return,
   else
     pd->joinid = NULL;
 
-  LIBC_PROBE (pthread_join_ret, 3, threadid, result, pd->result);
+  LIBC_PROBE (pthread_join_ret, 3, threadid, result, result);
 
   return result;
 }