LinuxThreads timer_create() / SIGEV_THREAD bug & fix

[Alex Shnitman]

Hi,

There's a small bug in LinuxThreads. It manifests itself when many
timers are created using timer_create() with sigev_notify =
SIGEV_THREAD.

The way it's supposed to work is thus: the first time it's called, a
thread is created to handle those timers. From then on, if the user
hasn't specified different thread attributes via the
sigev_notify_attributes field of struct sigevent, the same thread is
reused. Otherwise a new one is created.

The problem is in the function which searches for an existing matching
thread, namely __timer_thread_find_matching in timer_routines.c. If it
finds a matching thread, for some reason it *removes* it from the active
thread linked list (using list_unlink()) and then returns it. The thread
is never added back. So the next time timer_create() called, the thread
isn't found, and a new one is created. The next time this new thread
will be found and removed, and the next time, a new one created again!
Those removed threads continue to run, and if you create many timers,
soon the limit of 16 threads is exceeded and timer_create() bombs.

The results that the user sees are described in this earlier message to
this mailing list:
http://sources.redhat.com/ml/bug-glibc/2002-04/msg00593.html

The fix is simple: the matching thread that is found should not be
removed from the active thread list, since it's still active all right.
Therefore the following patch fixes the problem:

--- linuxthreads/sysdeps/pthread/timer_routines.c.old   2002-09-03 
14:28:09.000000000 +0300
+++ linuxthreads/sysdeps/pthread/timer_routines.c       2002-09-03 
14:28:38.000000000 +0300
@@ -531,7 +531,6 @@
       if (thread_attr_compare (desired_attr, &candidate->attr)
          && desired_clock_id == candidate->clock_id)
        {
-         list_unlink (iter);
          return candidate;
         }
 
Please CC me on any reply to this message since I'm not subscribed to
the list.

Thanks!


-- 
Alex Shnitman <address@hidden>
http://www.hectic.net/   UIN 188956
PGP 0xEC5D619D / E1 F2 7B 6C A0 31 80 28  63 B8 02 BA 65 C7 8B BA