RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 04:07:44 +00:00
Code Issues Activity Actions

Kernel: Fix kernel null deref on process crash during join_thread()

Browse source 
The join_thread() syscall is not supposed to be interruptible by
signals, but it was. And since the process death mechanism piggybacked
on signal interrupts, it was possible to interrupt a pthread_join() by
killing the process that was doing it, leading to confusing due to some
assumptions being made by Thread::finalize() for threads that have a
pending joiner.

This patch fixes the issue by making "interrupted by death" a distinct
block result separate from "interrupted by signal". Then we handle that
state in join_thread() and tidy things up so that thread finalization
doesn't get confused by the pending joiner being gone.

Test: Tests/Kernel/null-deref-crash-during-pthread_join.cpp
This commit is contained in:
Andreas Kling 2020-01-10 19:15:01 +01:00
parent 6a529ea425
commit 8c5cd97b45
7 changed files with 55 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Kernel/Thread.h
View file

@ -99,11 +99,14 @@ public:
virtual ~Blocker() {}
virtual bool should_unblock(Thread&, time_t now_s, long us) = 0;
virtual const char* state_string() const = 0;
void set_interrupted_by_death() { m_was_interrupted_by_death = true; }
bool was_interrupted_by_death() const { return m_was_interrupted_by_death; }
void set_interrupted_by_signal() { m_was_interrupted_while_blocked = true; }
bool was_interrupted_by_signal() const { return m_was_interrupted_while_blocked; }
private:
bool m_was_interrupted_while_blocked { false };
bool m_was_interrupted_by_death { false };
friend class Thread;
};
@ -260,6 +263,7 @@ public:
enum class BlockResult {
WokeNormally,
InterruptedBySignal,
InterruptedByDeath,
};
template<typename T, class... Args>
@ -285,6 +289,9 @@ public:
if (t.was_interrupted_by_signal())
return BlockResult::InterruptedBySignal;
if (t.was_interrupted_by_death())
return BlockResult::InterruptedByDeath;
return BlockResult::WokeNormally;
}