From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS3215 2.6.0.0/16 X-Spam-Status: No, score=-3.2 required=3.0 tests=AWL,BAYES_00,BODY_8BITS, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,NICE_REPLY_A,RCVD_IN_DNSWL_HI,SPF_HELO_PASS, SPF_PASS shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by dcvr.yhbt.net (Postfix) with ESMTPS id AD6DB1F8C6 for ; Mon, 9 Aug 2021 13:21:44 +0000 (UTC) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id B5ED73894C2A for ; Mon, 9 Aug 2021 13:21:43 +0000 (GMT) Received: from bird.elm.relay.mailchannels.net (bird.elm.relay.mailchannels.net [23.83.212.17]) by sourceware.org (Postfix) with ESMTPS id 45387385B83F for ; Mon, 9 Aug 2021 13:21:29 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 45387385B83F Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=gotplt.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gotplt.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 49BE7402DF6; Mon, 9 Aug 2021 13:21:27 +0000 (UTC) Received: from pdx1-sub0-mail-a49.g.dreamhost.com (100-96-16-191.trex.outbound.svc.cluster.local [100.96.16.191]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id CFE02402DE0; Mon, 9 Aug 2021 13:21:26 +0000 (UTC) X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org Received: from pdx1-sub0-mail-a49.g.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384) by 100.96.16.191 (trex/6.3.3); Mon, 09 Aug 2021 13:21:27 +0000 X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|siddhesh@gotplt.org X-MailChannels-Auth-Id: dreamhost X-Belong-Bottle: 01cc605263bd7664_1628515287081_3387342174 X-MC-Loop-Signature: 1628515287081:3329770643 X-MC-Ingress-Time: 1628515287081 Received: from pdx1-sub0-mail-a49.g.dreamhost.com (localhost [127.0.0.1]) by pdx1-sub0-mail-a49.g.dreamhost.com (Postfix) with ESMTP id 2A2F67E581; Mon, 9 Aug 2021 06:21:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=gotplt.org; h=subject:to :references:from:message-id:date:mime-version:in-reply-to :content-type:content-transfer-encoding; s=gotplt.org; bh=8+eR/C NrmdGuylk8+TPyfzick9M=; b=osMTe6+ZrBAPcX7bvtdV/FJeSafocN+088mdRJ dp0uKeir+j2mQhWwzvxLNFKDJa3xE/1GkWkiKibcv5g+GKEx9PDCCVgNNwWWl1t1 uW4k3xuhV0P9+GwxHTNl22BM1Me01W+feZ5NIlKtyUbDmb+713GaxRzxVh5EfNZY SzxkE= Received: from [192.168.1.159] (unknown [1.186.101.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: siddhesh@gotplt.org) by pdx1-sub0-mail-a49.g.dreamhost.com (Postfix) with ESMTPSA id 20F5B8CE0F; Mon, 9 Aug 2021 06:21:23 -0700 (PDT) Subject: Re: [PATCH] librt: fix NULL pointer dereference (bug 28213) To: =?UTF-8?B?0J3QuNC60LjRgtCwINCf0L7Qv9C+0LI=?= , libc-alpha@sourceware.org References: X-DH-BACKEND: pdx1-sub0-mail-a49 From: Siddhesh Poyarekar Message-ID: Date: Mon, 9 Aug 2021 18:51:19 +0530 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+e=80x24.org@sourceware.org Sender: "Libc-alpha" On 8/9/21 5:55 PM, =D0=9D=D0=B8=D0=BA=D0=B8=D1=82=D0=B0 =D0=9F=D0=BE=D0=BF= =D0=BE=D0=B2 via Libc-alpha wrote: > Helper thread frees copied attribute on NOTIFY_REMOVED message received= from the OS kernel. Unfortunately, it fails to check whether copied attr= ibute actually exists (data.attr !=3D NULL). This worked earlier because = free() checks passed pointer before actually attempting to release corres= ponding memory. But __pthread_attr_destroy assumes pointer is not NULL. S= o passing NULL pointer to __pthread_attr_destroy will result in segmentat= ion fault. This scenario is possible if notification->sigev_notify_attrib= utes =3D=3D NULL (which means default thread attributes should be used). Thank you, the fix looks good to me. Do you have a test case to go with = it? Thanks, Siddhesh