Skip to content

Commit

Permalink
Fix an issue on pcscd exit
Browse files Browse the repository at this point in the history
When pcscd exits we must first terminate any client thread on the
server side before closing the reader threads.
This is to prevent a client thread to access a now deactivated reader.

The error was:
^C00250854 [140433941325504] pcscdaemon.c:192:signal_thread() Received signal: 2
00000036 [140433941325504] pcscdaemon.c:226:signal_thread() Preparing for suicide
[...readers are stopped here...]
00000042 [140433995138368] pcscdaemon.c:809:at_exit() cleaning /run/pcscd
[...but we get a new request from a client...]
00000016 [140433906050752] winscard_svc.c:384:ContextThread() Received command: CMD_WAIT_READER_STATE_CHANGE from client 12
==================
WARNING: ThreadSanitizer: use of an invalid mutex (e.g. uninitialized or destroyed) (pid=62372)
    #0 pthread_mutex_lock <null> (pcscd+0x71ada) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #1 EHRegisterClientForEvent PCSC/src/eventhandler.c:68:8 (pcscd+0xe5b2a) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #2 ContextThread PCSC/src/winscard_svc.c:446:5 (pcscd+0xe5b2a)
    #3 __tsan_thread_start_func <null> (pcscd+0x53d66) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)

  Location is global 'ClientsWaitingForEvent_lock' of size 40 at 0x556bd69d67c8 (pcscd+0x14977c8)

  Mutex M0 (0x556bd69d67c8) created at:
    [failed to restore the stack]

SUMMARY: ThreadSanitizer: use of an invalid mutex (e.g. uninitialized or destroyed) (PCSC/src/pcscd+0x71ada) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914) in __interceptor_pthread_mutex_lock
==================
==================
WARNING: ThreadSanitizer: heap-use-after-free (pid=62372)
  Read of size 8 at 0x7b0c00000060 by thread T5:
    #0 list_insert_at PCSC/src/simclist.c:503:16 (pcscd+0xdea60) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #1 list_append PCSC/src/simclist.c:397:12 (pcscd+0xdea60)
    #2 EHRegisterClientForEvent PCSC/src/eventhandler.c:70:8 (pcscd+0xe5b39) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #3 ContextThread PCSC/src/winscard_svc.c:446:5 (pcscd+0xe5b39)
    #4 EHRegisterClientForEvent PCSC/src/eventhandler.c:70:8 (pcscd+0xe5b39) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #5 ContextThread PCSC/src/winscard_svc.c:446:5 (pcscd+0xe5b39)
    #6 __tsan_thread_start_func <null> (pcscd+0x53d66) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)

  Previous write of size 8 at 0x7b0c00000060 by main thread:
    #0 free <null> (pcscd+0x52c84) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #1 list_destroy PCSC/src/simclist.c:317:5 (pcscd+0xde590) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #2 EHDeinitializeEventStructures PCSC/src/eventhandler.c:152:2 (pcscd+0xd6866) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #3 SVCServiceRunLoop PCSC/src/pcscdaemon.c:124:4 (pcscd+0xd9649) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #4 main PCSC/src/pcscdaemon.c:801:2 (pcscd+0xd88e0) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)

  Thread T5 (tid=62379, running) created by main thread at:
    #0 pthread_create <null> (pcscd+0x53dfd) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #1 ThreadCreate PCSC/src/utils.c:184:8 (pcscd+0xe3c7b) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #2 CreateContextThread PCSC/src/winscard_svc.c:258:7 (pcscd+0xd931e) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #3 SVCServiceRunLoop PCSC/src/pcscdaemon.c:133:9 (pcscd+0xd931e)
    #4 main PCSC/src/pcscdaemon.c:801:2 (pcscd+0xd88e0) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)
    #5 main PCSC/src/pcscdaemon.c:801:2 (pcscd+0xd88e0) (BuildId: 1bcd3f8a880d8c656c6e6bbe77b504b573d68914)

SUMMARY: ThreadSanitizer: heap-use-after-free PCSC/src/simclist.c:503:16 in list_insert_at
==================
etc..
  • Loading branch information
LudovicRousseau committed Nov 19, 2023
1 parent 4ac2b12 commit 8cbab7b
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 2 deletions.
4 changes: 3 additions & 1 deletion src/pcscdaemon.c
Original file line number Diff line number Diff line change
Expand Up @@ -116,10 +116,12 @@ static void SVCServiceRunLoop(void)
#endif
(void)SYS_Sleep(1);

/* stop all the clients */
ContextsDeinitialize();

/* now stop all the drivers */
RFCleanupReaders();
EHDeinitializeEventStructures();
ContextsDeinitialize();
at_exit();
}

Expand Down
19 changes: 18 additions & 1 deletion src/winscard_svc.c
Original file line number Diff line number Diff line change
Expand Up @@ -155,8 +155,25 @@ void ContextsDeinitialize(void)
(void)listSize;
#endif
Log2(PCSC_LOG_DEBUG, "remaining threads: %d", listSize);
/* This is currently a no-op. It should terminate the threads properly. */

/* terminate all the client threads */
int rv = list_iterator_start(&contextsList);
if (0 == rv)
Log1(PCSC_LOG_ERROR, "list_iterator_start failed");
else
{
while (list_iterator_hasnext(&contextsList))
{
SCONTEXT * elt = list_iterator_next(&contextsList);
Log3(PCSC_LOG_DEBUG, "Cancel dwClientID=%d hContext: %p",
elt->dwClientID, elt);
EHTryToUnregisterClientForEvent(elt->dwClientID);
close(elt->dwClientID);
Log2(PCSC_LOG_DEBUG, "Waiting client: %d", elt->dwClientID);
pthread_join(elt->pthThread, NULL);
Log2(PCSC_LOG_INFO, "Client %d terminated", elt->dwClientID);
}
}
list_destroy(&contextsList);
(void)pthread_mutex_unlock(&contextsList_lock);
}
Expand Down

0 comments on commit 8cbab7b

Please sign in to comment.