mirror of
https://github.com/abseil/abseil-cpp.git
synced 2026-06-04 20:14:23 +08:00
9444b11e0c
Both Mutex and CondVar signal PerThreadSem/Waiter after satisfying the wait condition,
as the result the waiting thread may return w/o waiting on the
PerThreadSem/Waiter at all. If the waiting thread then exits, it currently
destroys Waiter object. As the result Waiter::Post can be called on
already destroyed object.
PerThreadSem/Waiter must be type-stable after creation and must not be destroyed.
The futex-based implementation is the only one that is not affected by the bug
since there is effectively nothing to destroy (maybe only UBSan/ASan
could complain about calling methods on a destroyed object).
Here is the problematic sequence of events:
1: void Mutex::Block(PerThreadSynch *s) {
2: while (s->state.load(std::memory_order_acquire) == PerThreadSynch::kQueued) {
3: if (!DecrementSynchSem(this, s, s->waitp->timeout)) {
4: PerThreadSynch *Mutex::Wakeup(PerThreadSynch *w) {
5: ...
6: w->state.store(PerThreadSynch::kAvailable, std::memory_order_release);
7: IncrementSynchSem(this, w);
8: ...
9: }
Consider line 6 is executed, then line 2 observes kAvailable and
line 3 is not called. The thread executing Mutex::Block returns from
the method, acquires the mutex, releases the mutex, exits and destroys
PerThreadSem/Waiter.
Now Mutex::Wakeup resumes and executes line 7 on the destroyed object. Boom!
CondVar uses a similar pattern.
Moreover the semaphore-based Waiter implementation is not even destruction-safe
(the Waiter cannot be used to signal own destruction). So even if Mutex/CondVar
would always pair Waiter::Post with Waiter::Wait before destroying PerThreadSem/Waiter,
it would still be subject to use-after-free bug on the semaphore.
PiperOrigin-RevId: 449159939
Change-Id: I497134fa8b6ce1294a422827c5f0de0e897cea31
57 lines
2.1 KiB
C++
57 lines
2.1 KiB
C++
/*
|
|
* Copyright 2017 The Abseil Authors.
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* https://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
// Interface for getting the current ThreadIdentity, creating one if necessary.
|
|
// See thread_identity.h.
|
|
//
|
|
// This file is separate from thread_identity.h because creating a new
|
|
// ThreadIdentity requires slightly higher level libraries (per_thread_sem
|
|
// and low_level_alloc) than accessing an existing one. This separation allows
|
|
// us to have a smaller //absl/base:base.
|
|
|
|
#ifndef ABSL_SYNCHRONIZATION_INTERNAL_CREATE_THREAD_IDENTITY_H_
|
|
#define ABSL_SYNCHRONIZATION_INTERNAL_CREATE_THREAD_IDENTITY_H_
|
|
|
|
#include "absl/base/internal/thread_identity.h"
|
|
#include "absl/base/port.h"
|
|
|
|
namespace absl {
|
|
ABSL_NAMESPACE_BEGIN
|
|
namespace synchronization_internal {
|
|
|
|
// Allocates and attaches a ThreadIdentity object for the calling thread.
|
|
// For private use only.
|
|
base_internal::ThreadIdentity* CreateThreadIdentity();
|
|
|
|
// Returns the ThreadIdentity object representing the calling thread; guaranteed
|
|
// to be unique for its lifetime. The returned object will remain valid for the
|
|
// program's lifetime; although it may be re-assigned to a subsequent thread.
|
|
// If one does not exist for the calling thread, allocate it now.
|
|
inline base_internal::ThreadIdentity* GetOrCreateCurrentThreadIdentity() {
|
|
base_internal::ThreadIdentity* identity =
|
|
base_internal::CurrentThreadIdentityIfPresent();
|
|
if (ABSL_PREDICT_FALSE(identity == nullptr)) {
|
|
return CreateThreadIdentity();
|
|
}
|
|
return identity;
|
|
}
|
|
|
|
} // namespace synchronization_internal
|
|
ABSL_NAMESPACE_END
|
|
} // namespace absl
|
|
|
|
#endif // ABSL_SYNCHRONIZATION_INTERNAL_CREATE_THREAD_IDENTITY_H_
|