plan9port

commit 2991442aef1cf020ffde43673433ee97ef322a53
parent a012d174336358f997ddcb0099c0b01499b053e4
Author: Russ Cox <rsc@swtch.com>
Date:   Tue, 15 Dec 2020 00:05:17 -0500

libthread: fix use after free of first thread in each proc

This was causing sporadic but frequent crashes at startup
in 9pserve on the new M1 Macs, correctly diagnosing a
use-after-free.

Diffstat:
M
src/libthread/thread.c
 | 
10
+++++++++-

1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/libthread/thread.c b/src/libthread/thread.c
@@ -411,7 +411,14 @@ Top:
 		p->nthread--;
 /*print("nthread %d\n", p->nthread); */
 		_threadstkfree(t->stk, t->stksize);
-		free(t);
+		/*
+		 * Cannot free p->thread0 yet: it is used for the
+		 * context switches back to the scheduler.
+		 * Instead, we will free it at the end of this function.
+		 * But all the other threads can be freed now.
+		 */
+		if(t != p->thread0)
+			free(t);
 	}
 
 	for(;;){
@@ -490,6 +497,7 @@ Out:
 	unlock(&threadnproclock);
 	unlock(&p->lock);
 	_threadsetproc(nil);
+	free(p->thread0);
 	free(p);
 	_threadpexit();
 }