Skip to content

Commit dbbf92c

Browse files
committed
Fix race in blas_thread_shutdown.
blas_server_avail was read without holding server_lock. If multiple threads call blas_thread_shutdown simultaneously, for example, by calling fork(), then they can attempt to shut down multiple times. This can lead to a segmentation fault.
1 parent cb429d6 commit dbbf92c

File tree

1 file changed

+19
-18
lines changed

1 file changed

+19
-18
lines changed

driver/others/blas_server.c

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1024,38 +1024,39 @@ int BLASFUNC(blas_thread_shutdown)(void){
10241024

10251025
int i;
10261026

1027-
if (!blas_server_avail) return 0;
1028-
10291027
LOCK_COMMAND(&server_lock);
10301028

1031-
for (i = 0; i < blas_num_threads - 1; i++) {
1029+
if (blas_server_avail) {
10321030

1031+
for (i = 0; i < blas_num_threads - 1; i++) {
10331032

1034-
pthread_mutex_lock (&thread_status[i].lock);
10351033

1036-
atomic_store_queue(&thread_status[i].queue, (blas_queue_t *)-1);
1037-
thread_status[i].status = THREAD_STATUS_WAKEUP;
1038-
pthread_cond_signal (&thread_status[i].wakeup);
1034+
pthread_mutex_lock (&thread_status[i].lock);
10391035

1040-
pthread_mutex_unlock(&thread_status[i].lock);
1036+
atomic_store_queue(&thread_status[i].queue, (blas_queue_t *)-1);
1037+
thread_status[i].status = THREAD_STATUS_WAKEUP;
1038+
pthread_cond_signal (&thread_status[i].wakeup);
10411039

1042-
}
1040+
pthread_mutex_unlock(&thread_status[i].lock);
10431041

1044-
for(i = 0; i < blas_num_threads - 1; i++){
1045-
pthread_join(blas_threads[i], NULL);
1046-
}
1042+
}
10471043

1048-
for(i = 0; i < blas_num_threads - 1; i++){
1049-
pthread_mutex_destroy(&thread_status[i].lock);
1050-
pthread_cond_destroy (&thread_status[i].wakeup);
1051-
}
1044+
for(i = 0; i < blas_num_threads - 1; i++){
1045+
pthread_join(blas_threads[i], NULL);
1046+
}
1047+
1048+
for(i = 0; i < blas_num_threads - 1; i++){
1049+
pthread_mutex_destroy(&thread_status[i].lock);
1050+
pthread_cond_destroy (&thread_status[i].wakeup);
1051+
}
10521052

10531053
#ifdef NEED_STACKATTR
1054-
pthread_attr_destory(&attr);
1054+
pthread_attr_destroy(&attr);
10551055
#endif
10561056

1057-
blas_server_avail = 0;
1057+
blas_server_avail = 0;
10581058

1059+
}
10591060
UNLOCK_COMMAND(&server_lock);
10601061

10611062
return 0;

0 commit comments

Comments
 (0)