RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-06-30 05:42:06 +00:00
Code Issues Activity Actions

Kernel: Fix kernel null deref on process crash during join_thread()

Browse source 
The join_thread() syscall is not supposed to be interruptible by
signals, but it was. And since the process death mechanism piggybacked
on signal interrupts, it was possible to interrupt a pthread_join() by
killing the process that was doing it, leading to confusing due to some
assumptions being made by Thread::finalize() for threads that have a
pending joiner.

This patch fixes the issue by making "interrupted by death" a distinct
block result separate from "interrupted by signal". Then we handle that
state in join_thread() and tidy things up so that thread finalization
doesn't get confused by the pending joiner being gone.

Test: Tests/Kernel/null-deref-crash-during-pthread_join.cpp
This commit is contained in:
Andreas Kling 2020-01-10 19:15:01 +01:00
parent 6a529ea425
commit 8c5cd97b45
7 changed files with 55 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

10
Kernel/Thread.cpp
View file

@ -155,10 +155,8 @@ void Thread::set_should_die()
if (is_blocked()) {
ASSERT(in_kernel());
ASSERT(m_blocker != nullptr);
// We're blocked in the kernel. Pretend to have
// been interrupted by a signal (perhaps that is
// what has actually killed us).
m_blocker->set_interrupted_by_signal();
// We're blocked in the kernel.
m_blocker->set_interrupted_by_death();
unblock();
} else if (!in_kernel()) {
// We're executing in userspace (and we're clearly
@ -209,7 +207,7 @@ u64 Thread::sleep(u32 ticks)
u64 wakeup_time = g_uptime + ticks;
auto ret = current->block<Thread::SleepBlocker>(wakeup_time);
if (wakeup_time > g_uptime) {
ASSERT(ret == Thread::BlockResult::InterruptedBySignal);
ASSERT(ret != Thread::BlockResult::WokeNormally);
}
return wakeup_time;
}
@ -219,7 +217,7 @@ u64 Thread::sleep_until(u64 wakeup_time)
ASSERT(state() == Thread::Running);
auto ret = current->block<Thread::SleepBlocker>(wakeup_time);
if (wakeup_time > g_uptime)
ASSERT(ret == Thread::BlockResult::InterruptedBySignal);
ASSERT(ret != Thread::BlockResult::WokeNormally);
return wakeup_time;
}