From: Volker Lendecke <vl@samba.org>
Date: Tue, 28 Jul 2026 11:25:43 +0000 (+0200)
Subject: lib: Fix undefined behaviour at fork time in pthreadpool
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;ds=inline;p=thirdparty%2Fsamba.git

lib: Fix undefined behaviour at fork time in pthreadpool

If a pthread times out at the same time with a fork, ETIMEDOUT is
overwritten and not being taken care of. This means that we can race
with the forking thread destroying pool->condvar in the next round of
the thread's while(1) loop. pthread_cond_wait() on a condition
variable that has been destroyed is not a good idea.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16191

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Jul 30 17:51:29 UTC 2026 on atb-devel-224
---

diff --git a/lib/pthreadpool/pthreadpool.c b/lib/pthreadpool/pthreadpool.c
index cbabec9e25d..7529fe10c72 100644
--- a/lib/pthreadpool/pthreadpool.c
+++ b/lib/pthreadpool/pthreadpool.c
@@ -591,8 +591,10 @@ static void *pthreadpool_server(void *arg)
 
 		while ((pool->num_jobs == 0) && !pool->stopped) {
 
+			int wait_res;
+
 			pool->num_idle += 1;
-			res = pthread_cond_timedwait(
+			wait_res = pthread_cond_timedwait(
 				&pool->condvar, &pool->mutex, &ts);
 			pool->num_idle -= 1;
 
@@ -626,7 +628,7 @@ static void *pthreadpool_server(void *arg)
 				assert(res == 0);
 			}
 
-			if (res == ETIMEDOUT) {
+			if (wait_res == ETIMEDOUT) {
 
 				if (pool->num_jobs == 0) {
 					/*
@@ -639,7 +641,7 @@ static void *pthreadpool_server(void *arg)
 
 				break;
 			}
-			assert(res == 0);
+			assert(wait_res == 0);
 		}
 
 		if (pthreadpool_get_job(pool, &job)) {