From: Jeff Mahoney Date: Tue, 22 Aug 2017 15:01:30 +0000 (-0500) Subject: xfs_repair: clear pthread_t when pthread_create fails X-Git-Tag: v4.13.0-rc1~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=53dc81db1c86bc69c7e99961f5519e4d259a8f8d;p=thirdparty%2Fxfsprogs-dev.git xfs_repair: clear pthread_t when pthread_create fails pf_queuing_worker and pf_create_prefetch_thread both try to handle thread creation failure gracefully, but assume that pthread_create doesn't modify the pthread_t when it fails. From the pthread_create man page: On success, pthread_create() returns 0; on error, it returns an error number, and the contents of *thread are undefined. In fact, glibc's pthread_create writes the pthread_t value before calling clone(). When we join the created threads in cleanup_inode_prefetch and the cleanup stage of pf_queuing_worker, we assume that if the pthread_t is nonzero that it's a valid thread handle and end up crashing in pthread_join. This patch zeros out the handle after pthread_create failure. Signed-off-by: Jeff Mahoney Reviewed-by: Eric Sandeen Signed-off-by: Eric Sandeen --- diff --git a/repair/prefetch.c b/repair/prefetch.c index ff5060613..044fab2e5 100644 --- a/repair/prefetch.c +++ b/repair/prefetch.c @@ -703,6 +703,7 @@ pf_queuing_worker( if (err != 0) { do_warn(_("failed to create prefetch thread: %s\n"), strerror(err)); + args->io_threads[i] = 0; if (i == 0) { pf_start_processing(args); return NULL; @@ -816,6 +817,7 @@ pf_create_prefetch_thread( if (err != 0) { do_warn(_("failed to create prefetch thread: %s\n"), strerror(err)); + args->queuing_thread = 0; cleanup_inode_prefetch(args); }