From 3b78cc7c0f60423a50022cfa66c7d8fad32a04a2 Mon Sep 17 00:00:00 2001 From: kib Date: Tue, 28 May 2013 04:54:16 +0000 Subject: The getcontext() from the __fillcontextx() call in the check_deferred_signal() returns twice, since handle_signal() emulates the return from the normal signal handler by sigreturn(2)ing the passed context. Second return is performed on the destroyed stack frame, because __fillcontextx() has already returned. This causes undefined and bad behaviour, usually the victim thread gets SIGSEGV. Avoid nested frame and the need to return from it by doing direct call to getcontext() in the check_deferred_signal() and using a new private libc helper __fillcontextx2() to complement the context with the extended CPU state if the deferred signal is still present. The __fillcontextx() is now unused, but is kept to allow older libthr.so to be used with the new libc. Mark __fillcontextx() as returning twice [1]. Reported by: pgj Pointy hat to: kib Discussed with: dim Tested by: pgj, dim Suggested by: jilles [1] MFC after: 1 week --- lib/libthr/thread/thr_sig.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'lib/libthr/thread') diff --git a/lib/libthr/thread/thr_sig.c b/lib/libthr/thread/thr_sig.c index 86b3a9b..4dbb252 100644 --- a/lib/libthr/thread/thr_sig.c +++ b/lib/libthr/thread/thr_sig.c @@ -323,8 +323,13 @@ check_deferred_signal(struct pthread *curthread) return; #if defined(__amd64__) || defined(__i386__) - uc = alloca(__getcontextx_size()); - __fillcontextx((char *)uc); + int uc_len; + uc_len = __getcontextx_size(); + uc = alloca(uc_len); + getcontext(uc); + if (curthread->deferred_siginfo.si_signo == 0) + return; + __fillcontextx2((char *)uc); #else ucontext_t ucv; uc = &ucv; -- cgit v1.1