Re: lib/49006: thread specific storage not always initialized to NULL

[Tony Cook <tony%develop-help.com@localhost>]

On Thu, Jul 17, 2014 at 10:45:00AM +0000, Martin Husemann wrote:
> The following reply was made to PR lib/49006; it has been noted by GNATS.
> 
> From: Martin Husemann <martin%duskware.de@localhost>
> To: gnats-bugs%NetBSD.org@localhost
> Cc: 
> Subject: Re: lib/49006: thread specific storage not always initialized to NULL
> Date: Thu, 17 Jul 2014 12:40:58 +0200
> 
>  This seems to work correctly in -current.

Looks like it was fixed in this chunk of v1.9 [1] of
/lib/libpthread/pthread_tsd.c:

@@ -206,17 +294,24 @@ pthread__destroy_tsd(pthread_t self)
        do {
                done = 1;
                for (i = 0; i < PTHREAD_KEYS_MAX; i++) {
-                       if (self->pt_specific[i] != NULL) {
-                               pthread_mutex_lock(&tsd_mutex);
+                       struct pt_specific *pt = &self->pt_specific[i];
+                       if (pt->pts_next.ptqe_prev == NULL)
+                               continue;
+                       pthread_mutex_lock(&tsd_mutex);
+
+                       if (pt->pts_next.ptqe_prev != NULL)  {
+                               PTQ_REMOVE(&pthread__tsd_list[i], pt, pts_next);
+                               val = pt->pts_value;
+                               pt->pts_value = NULL;
+                               pt->pts_next.ptqe_prev = NULL;
                                destructor = pthread__tsd_destructors[i];
-                               pthread_mutex_unlock(&tsd_mutex);
-                               if (destructor != NULL) {
-                                       done = 0;
-                                       val = self->pt_specific[i];
-                                       /* See above */
-                                       self->pt_specific[i] = NULL;
-                                       (*destructor)(val);
-                               }
+                       } else
+                               destructor = NULL;
+
+                       pthread_mutex_unlock(&tsd_mutex);
+                       if (destructor != NULL) {
+                               done = 0;
+                               (*destructor)(val);
                        }
                }
        } while (!done && iterations--);

The removed code only set self->pt_specific[i] to NULL when the entry
has a destructor, the new code doesn't have that flaw, assuming I
understand it.

Thanks,
Tony

[1] 
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libpthread/pthread_tsd.c.diff?r1=1.8&r2=1.9&only_with_tag=MAIN