use a dedicated futex object for pthread_join instead of tid field

the tid field in the pthread structure is not volatile, and really
shouldn't be, so as not to limit the compiler's ability to reorder,
merge, or split loads in code paths that may be relevant to
performance (like controlling lock ownership).

however, use of objects which are not volatile or atomic with futex
wait is inherently broken, since the compiler is free to transform a
single load into multiple loads, thereby using a different value for
the controlling expression of the loop and the value passed to the
futex syscall, leading the syscall to block instead of returning.

reportedly glibc's pthread_join was actually affected by an equivalent
issue in glibc on s390.

add a separate, dedicated join_futex object for pthread_join to use.

2 files changed, 5 insertions, 4 deletions

diff --git a/src/thread/pthread_create.c b/src/thread/pthread_create.c
index 439ee363..ac06d7a7 100644
--- a/src/thread/pthread_create.c
+++ b/src/thread/pthread_create.c
@@ -282,9 +282,10 @@ int __pthread_create(pthread_t *restrict res, const pthread_attr_t *restrict att
 	new->robust_list.head = &new->robust_list.head;
 	new->unblock_cancel = self->cancel;
 	new->CANARY = self->CANARY;
+	new->join_futex = -1;
 
 	a_inc(&libc.threads_minus_1);
-	ret = __clone((c11 ? start_c11 : start), stack, flags, new, &new->tid, TP_ADJ(new), &new->tid);
+	ret = __clone((c11 ? start_c11 : start), stack, flags, new, &new->tid, TP_ADJ(new), &new->join_futex);
 
 	__release_ptc();
 
diff --git a/src/thread/pthread_join.c b/src/thread/pthread_join.c
index b7175c09..67eaf9d8 100644
--- a/src/thread/pthread_join.c
+++ b/src/thread/pthread_join.c
@@ -12,8 +12,8 @@ int __pthread_timedjoin_np(pthread_t t, void **res, const struct timespec *at)
 	__pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
 	if (cs == PTHREAD_CANCEL_ENABLE) __pthread_setcancelstate(cs, 0);
 	if (t->detached) a_crash();
-	while ((tmp = t->tid) && r != ETIMEDOUT && r != EINVAL)
-		r = __timedwait_cp(&t->tid, tmp, CLOCK_REALTIME, at, 0);
+	while ((tmp = t->join_futex) && r != ETIMEDOUT && r != EINVAL)
+		r = __timedwait_cp(&t->join_futex, tmp, CLOCK_REALTIME, at, 0);
 	__pthread_setcancelstate(cs, 0);
 	if (r == ETIMEDOUT || r == EINVAL) return r;
 	a_barrier();
@@ -29,7 +29,7 @@ int __pthread_join(pthread_t t, void **res)
 
 int __pthread_tryjoin_np(pthread_t t, void **res)
 {
-	return t->tid ? EBUSY : __pthread_join(t, res);
+	return t->join_futex ? EBUSY : __pthread_join(t, res);
 }
 
 weak_alias(__pthread_tryjoin_np, pthread_tryjoin_np);