[patches] Backport of timers race fix applied

["Joseph S. Myers" <joseph@xxxxxxxxxxxxxxxx>]

I've applied this backport of a patch to fix a race in timer_delete to 
EGLIBC 2.7, 2.6 and 2.5.

Index: ChangeLog.eglibc
===================================================================
--- ChangeLog.eglibc	(revision 3997)
+++ ChangeLog.eglibc	(working copy)
@@ -1,3 +1,21 @@
+2007-10-28  Joseph Myers  <joseph@xxxxxxxxxxxxxxxx>
+
+	Backport:
+	2007-10-28  Ulrich Drepper  <drepper@xxxxxxxxxx>
+	[BZ #5220]
+	* sysdeps/unix/sysv/linux/kernel-posix-timers.h: Declare
+	__active_timer_sigev_thread and __active_timer_sigev_thread_lock.
+	(struct timer): Add next element.
+	* sysdeps/unix/sysv/linux/timer_create.c: For SIGEV_THREAD timers,
+	enqueue timer structure into __active_timer_sigev_thread list.
+	* sysdeps/unix/sysv/linux/timer_delete.c: For SIGEV_THREAD timers,
+	remove timer struct from __active_timer_sigev_thread.
+	* sysdeps/unix/sysv/linux/timer_routines.c (timer_helper_thread):
+	Before using timer structure make sure it is still on the
+	__active_timer_sigev_thread list.  Keep lock until done.
+	Define __active_timer_sigev_thread and
+	__active_timer_sigev_thread_lock.
+
 2007-10-23  Jim Blandy  <jimb@xxxxxxxxxxxxxxxx>
 
 	* bits/wchar.h (__WCHAR_MIN): Add missing underscores to name.
Index: nptl/sysdeps/unix/sysv/linux/timer_routines.c
===================================================================
--- nptl/sysdeps/unix/sysv/linux/timer_routines.c	(revision 3997)
+++ nptl/sysdeps/unix/sysv/linux/timer_routines.c	(working copy)
@@ -1,4 +1,4 @@
-/* Copyright (C) 2003, 2004, 2005, 2006 Free Software Foundation, Inc.
+/* Copyright (C) 2003, 2004, 2005, 2006, 2007 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@xxxxxxxxxx>, 2003.
 
@@ -27,6 +27,12 @@
 #include "kernel-posix-timers.h"
 
 
+/* List of active SIGEV_THREAD timers.  */
+struct timer *__active_timer_sigev_thread;
+/* Lock for the __active_timer_sigev_thread.  */
+pthread_mutex_t __active_timer_sigev_thread_lock = PTHREAD_MUTEX_INITIALIZER;
+
+
 struct thread_start_data
 {
   void (*thrfunc) (sigval_t);
@@ -95,19 +101,36 @@
 	  if (si.si_code == SI_TIMER)
 	    {
 	      struct timer *tk = (struct timer *) si.si_ptr;
-	      struct thread_start_data *td = malloc (sizeof (*td));
 
-	      /* There is not much we can do if the allocation fails.  */
-	      if (td != NULL)
+	      /* Check the timer is still used and will not go away
+		 while we are reading the values here.  */
+	      pthread_mutex_lock (&__active_timer_sigev_thread_lock);
+
+	      struct timer *runp = __active_timer_sigev_thread;
+	      while (runp != NULL)
+		if (runp == tk)
+		  break;
+		else
+		  runp = runp->next;
+
+	      if (runp != NULL)
 		{
-		  /* That is the signal we are waiting for.  */
-		  td->thrfunc = tk->thrfunc;
-		  td->sival = tk->sival;
+		  struct thread_start_data *td = malloc (sizeof (*td));
 
-		  pthread_t th;
-		  (void) pthread_create (&th, &tk->attr, timer_sigev_thread,
-					 td);
+		  /* There is not much we can do if the allocation fails.  */
+		  if (td != NULL)
+		    {
+		      /* This is the signal we are waiting for.  */
+		      td->thrfunc = tk->thrfunc;
+		      td->sival = tk->sival;
+
+		      pthread_t th;
+		      (void) pthread_create (&th, &tk->attr,
+					     timer_sigev_thread, td);
+		    }
 		}
+
+	      pthread_mutex_unlock (&__active_timer_sigev_thread_lock);
 	    }
 	  else if (si.si_code == SI_TKILL)
 	    /* The thread is canceled.  */
Index: nptl/sysdeps/unix/sysv/linux/kernel-posix-timers.h
===================================================================
--- nptl/sysdeps/unix/sysv/linux/kernel-posix-timers.h	(revision 3997)
+++ nptl/sysdeps/unix/sysv/linux/kernel-posix-timers.h	(working copy)
@@ -1,4 +1,4 @@
-/* Copyright (C) 2003 Free Software Foundation, Inc.
+/* Copyright (C) 2003, 2007 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@xxxxxxxxxx>, 2003.
 
@@ -35,7 +35,12 @@
 /* TID of the helper thread.  */
 extern pid_t __helper_tid attribute_hidden;
 
+/* List of active SIGEV_THREAD timers.  */
+extern struct timer *__active_timer_sigev_thread attribute_hidden;
+/* Lock for the __active_timer_sigev_thread.  */
+extern pthread_mutex_t __active_timer_sigev_thread_lock attribute_hidden;
 
+
 /* Type of timers in the kernel.  */
 typedef int kernel_timer_t;
 
@@ -57,4 +62,7 @@
   void (*thrfunc) (sigval_t);
   sigval_t sival;
   pthread_attr_t attr;
+
+  /* Next element in list of active SIGEV_THREAD timers.  */
+  struct timer *next;
 };
Index: nptl/sysdeps/unix/sysv/linux/timer_delete.c
===================================================================
--- nptl/sysdeps/unix/sysv/linux/timer_delete.c	(revision 3997)
+++ nptl/sysdeps/unix/sysv/linux/timer_delete.c	(working copy)
@@ -1,4 +1,4 @@
-/* Copyright (C) 2003 Free Software Foundation, Inc.
+/* Copyright (C) 2003, 2007 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@xxxxxxxxxx>, 2003.
 
@@ -54,6 +54,27 @@
 
       if (res == 0)
 	{
+	  if (kt->sigev_notify == SIGEV_THREAD)
+	    {
+	      /* Remove the timer from the list.  */
+	      pthread_mutex_lock (&__active_timer_sigev_thread_lock);
+	      if (__active_timer_sigev_thread == kt)
+		__active_timer_sigev_thread = kt->next;
+	      else
+		{
+		  struct timer *prevp = __active_timer_sigev_thread;
+		  while (prevp->next != NULL)
+		    if (prevp->next == kt)
+		      {
+			prevp->next = kt->next;
+			break;
+		      }
+		    else
+		      prevp = prevp->next;
+		}
+	      pthread_mutex_unlock (&__active_timer_sigev_thread_lock);
+	    }
+
 # ifndef __ASSUME_POSIX_TIMERS
 	  /* We know the syscall support is available.  */
 	  __no_posix_timers = 1;
Index: nptl/sysdeps/unix/sysv/linux/timer_create.c
===================================================================
--- nptl/sysdeps/unix/sysv/linux/timer_create.c	(revision 3997)
+++ nptl/sysdeps/unix/sysv/linux/timer_create.c	(working copy)
@@ -206,6 +206,13 @@
 				      syscall_clockid, &sev, &newp->ktimerid);
 	      if (! INTERNAL_SYSCALL_ERROR_P (res, err))
 		{
+		  /* Add to the queue of active timers with thread
+		     delivery.  */
+		  pthread_mutex_lock (&__active_timer_sigev_thread_lock);
+		  newp->next = __active_timer_sigev_thread;
+		  __active_timer_sigev_thread = newp;
+		  pthread_mutex_unlock (&__active_timer_sigev_thread_lock);
+
 		  *timerid = (timer_t) newp;
 		  return 0;
 		}

-- 
Joseph S. Myers
joseph@xxxxxxxxxxxxxxxx