>From f850621962cb57c7bebfc93bd28db1f26be213aa Mon Sep 17 00:00:00 2001 From: Susant Sahani Date: Sat, 23 Nov 2013 13:12:59 +0530 Subject: [PATCH 3/3] Race in Race in clnt_vc_create The function clnt_create is *not* thread safe. Race conditions in the function clnt_vc_create that accesses static data disrupt, which is *not* protected by any mutex. When more than one thread access it it has become a nonlocal side effect . This race conditions can lead to undesired behaviour . By introducing the mutex disrupt_lock the function clnt_vc_create is serialized Signed-off-by: Susant Sahani --- src/clnt_vc.c | 5 +++++ src/mt_misc.c | 3 +++ 2 files changed, 8 insertions(+) diff --git a/src/clnt_vc.c b/src/clnt_vc.c index 2eab9e4..cbbfc58 100644 --- a/src/clnt_vc.c +++ b/src/clnt_vc.c @@ -173,14 +173,17 @@ clnt_vc_create(fd, raddr, prog, vers, sendsz, recvsz) struct timeval now; struct rpc_msg call_msg; static u_int32_t disrupt; + extern pthread_mutex_t disrupt_lock; sigset_t mask; sigset_t newmask; struct sockaddr_storage ss; socklen_t slen; struct __rpc_sockinfo si; + mutex_lock(&disrupt_lock); if (disrupt == 0) disrupt = (u_int32_t)(long)raddr; + mutex_unlock(&disrupt_lock); cl = (CLIENT *)mem_alloc(sizeof (*cl)); ct = (struct ct_data *)mem_alloc(sizeof (*ct)); @@ -270,7 +273,9 @@ clnt_vc_create(fd, raddr, prog, vers, sendsz, recvsz) * Initialize call message */ (void)gettimeofday(&now, NULL); + mutex_lock(&disrupt_lock); call_msg.rm_xid = ((u_int32_t)++disrupt) ^ __RPC_GETXID(&now); + mutex_unlock(&disrupt_lock); call_msg.rm_direction = CALL; call_msg.rm_call.cb_rpcvers = RPC_MSG_VERSION; call_msg.rm_call.cb_prog = (u_int32_t)prog; diff --git a/src/mt_misc.c b/src/mt_misc.c index ddbb0a5..d459dec 100644 --- a/src/mt_misc.c +++ b/src/mt_misc.c @@ -97,6 +97,9 @@ pthread_mutex_t nc_db_lock = PTHREAD_MUTEX_INITIALIZER; /* protects static port and startport (bindresvport.c) */ pthread_mutex_t port_lock = PTHREAD_MUTEX_INITIALIZER; +/* protects static disrupt (clnt_vc.c) */ +pthread_mutex_t disrupt_lock = PTHREAD_MUTEX_INITIALIZER; + #undef rpc_createerr struct rpc_createerr rpc_createerr; -- 1.8.4.2