diff options
authorRich Felker <>2018-12-09 23:28:47 -0500
committerRich Felker <>2018-12-09 23:28:47 -0500
commit1a6d6f131bd60ec2a858b34100049f0c042089f2 (patch)
parent26c66c485c04fa782b8c6f7450bf008f4457b5a8 (diff)
fix and future-proof against stack overflow in aio io threads
aio threads not using SIGEV_THREAD notification are created with small stacks and no guard page, which is possible since they only run the code for the requested io operation, not any application code. the motivation is not creating a lot of VMAs. however, the io thread needs to be able to receive a cancellation signal in case aio_cancel (implemented via pthread_cancel) is called. this requires sufficient stack space for a signal frame, which PTHREAD_STACK_MIN does not necessarily include. in principle MINSIGSTKSZ from signal.h should give us sufficient space for a signal frame, but the value is incorrect on some existing archs due to kernel addition of new vector register support without consideration for impact on ABI. some powerpc models exceed MINSIGSTKSZ by about 0.5k, and x86[_64] with AVX-512 can exceed it by up to about 1.5k. so use MINSIGSTKSZ+2048 to allow for the discrepancy plus some working space. unfortunately, it's possible that signal frame sizes could continue to grow, and some archs (aarch64) explicitly specify that they may. passing of a runtime value for MINSIGSTKSZ via AT_MINSIGSTKSZ in the aux vector was added to aarch64 linux, and presumably other archs will use this mechanism to report if they further increase the signal frame size. when AT_MINSIGSTKSZ is present, assume it's correct, so that we only need a small amount of working space in addition to it; in this case just add 512.
1 files changed, 12 insertions, 1 deletions
diff --git a/src/aio/aio.c b/src/aio/aio.c
index 628e8420..38943bc0 100644
--- a/src/aio/aio.c
+++ b/src/aio/aio.c
@@ -5,6 +5,7 @@
#include <errno.h>
#include <unistd.h>
#include <stdlib.h>
+#include <sys/auxv.h>
#include "syscall.h"
#include "atomic.h"
#include "pthread_impl.h"
@@ -256,6 +257,15 @@ static void *io_thread_func(void *ctx)
return 0;
+static size_t io_thread_stack_size = MINSIGSTKSZ+2048;
+static pthread_once_t init_stack_size_once;
+static void init_stack_size()
+ unsigned long val = __getauxval(AT_MINSIGSTKSZ);
+ if (val > MINSIGSTKSZ) io_thread_stack_size = val + 512;
static int submit(struct aiocb *cb, int op)
int ret = 0;
@@ -271,8 +281,9 @@ static int submit(struct aiocb *cb, int op)
} else {
+ pthread_once(&init_stack_size_once, init_stack_size);
- pthread_attr_setstacksize(&a, PTHREAD_STACK_MIN);
+ pthread_attr_setstacksize(&a, io_thread_stack_size);
pthread_attr_setguardsize(&a, 0);
pthread_attr_setdetachstate(&a, PTHREAD_CREATE_DETACHED);