From: Rich Felker <dalias@aerifal.cx>
Date: Thu, 21 Mar 2019 17:58:12 +0000 (-0400)
Subject: fix data race choosing next key slot in pthread_key_create
X-Git-Tag: v1.1.22~12
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=59f88d766263344ce3e124d969ba66720aff4590;p=oweals%2Fmusl.git

fix data race choosing next key slot in pthread_key_create

commit 84d061d5a31c9c773e29e1e2b1ffe8cb9557bc58 wrongly moved the
access to the global next_key outside of the scope of the lock. the
error manifested as spurious failure to find an available key slot
under concurrent calls to pthread_key_create, since the stopping
condition could be met after only a small number of slots were
examined.
---

diff --git a/src/thread/pthread_key_create.c b/src/thread/pthread_key_create.c
index 210605c6..d1120941 100644
--- a/src/thread/pthread_key_create.c
+++ b/src/thread/pthread_key_create.c
@@ -22,7 +22,6 @@ weak_alias(dummy_0, __tl_unlock);
 
 int __pthread_key_create(pthread_key_t *k, void (*dtor)(void *))
 {
-	pthread_key_t j = next_key;
 	pthread_t self = __pthread_self();
 
 	/* This can only happen in the main thread before
@@ -33,6 +32,7 @@ int __pthread_key_create(pthread_key_t *k, void (*dtor)(void *))
 	if (!dtor) dtor = nodtor;
 
 	__pthread_rwlock_wrlock(&key_lock);
+	pthread_key_t j = next_key;
 	do {
 		if (!keys[j]) {
 			keys[next_key = *k = j] = dtor;