fix(profiler): close SIGVTALRM race in pthread_create wrapper teardown (PROF-14603)#529
fix(profiler): close SIGVTALRM race in pthread_create wrapper teardown (PROF-14603)#529jbachorik wants to merge 1 commit into
Conversation
JavaThread::~JavaThread / OSThread::~OSThread crashed on JDK 25 when the ddprof pthread_create hook delivered SIGVTALRM between Profiler::unregisterThread() returning and ProfiledThread::release() acquiring its internal guard. The signal handler called currentSignalSafe() and dereferenced the now-freed ProfiledThread. Fix: extract unregister_and_release(tid) — a noinline helper that holds a SignalBlocker for the entire unregister+release sequence. Both start_routine_wrapper and start_routine_wrapper_spec invoke it; the race window is eliminated without duplicating signal-masking logic. Same SignalBlocker pattern is applied to perfEvents_linux.cpp's pthread_setspecific_hook teardown path. thread.h guards clearCurrentThreadTLS() with #ifdef UNIT_TEST so it is absent from production builds; GtestTaskBuilder.kt adds -DUNIT_TEST to the gtest compiler flags so the guarded method compiles in tests. thread_teardown_safety_ut.cpp adds an acceptance-test suite (ThreadTeardownSafetyTest T-01..T-10) covering the full teardown lifecycle under signal load. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Folded into #510. The PROF-14603 race fix is now the third commit on |
CI Test ResultsRun: #25810280499 | Commit:
Status Overview
Legend: ✅ passed | ❌ failed | ⚪ skipped | 🚫 cancelled Failed Testsmusl-amd64/debug / 17-librcaJob: View logs No detailed failure information available. Check the job logs. musl-amd64/debug / 25-librcaJob: View logs No detailed failure information available. Check the job logs. musl-aarch64/debug / 25-librcaJob: View logs No detailed failure information available. Check the job logs. musl-amd64/debug / 11-librcaJob: View logs No detailed failure information available. Check the job logs. musl-aarch64/debug / 8-librcaJob: View logs No detailed failure information available. Check the job logs. musl-aarch64/debug / 11-librcaJob: View logs No detailed failure information available. Check the job logs. musl-amd64/debug / 21-librcaJob: View logs No detailed failure information available. Check the job logs. musl-aarch64/debug / 17-librcaJob: View logs No detailed failure information available. Check the job logs. glibc-amd64/debug / 8-j9Job: View logs No detailed failure information available. Check the job logs. glibc-amd64/debug / 11-j9Job: View logs No detailed failure information available. Check the job logs. musl-amd64/debug / 8-librcaJob: View logs No detailed failure information available. Check the job logs. glibc-amd64/debug / 17-j9Job: View logs No detailed failure information available. Check the job logs. glibc-amd64/debug / 17-graalJob: View logs No detailed failure information available. Check the job logs. glibc-amd64/debug / 11Job: View logs No detailed failure information available. Check the job logs. glibc-amd64/debug / 8-ibmJob: View logs No detailed failure information available. Check the job logs. glibc-amd64/debug / 8-orclJob: View logs No detailed failure information available. Check the job logs. glibc-amd64/debug / 25Job: View logs No detailed failure information available. Check the job logs. glibc-amd64/debug / 17Job: View logs No detailed failure information available. Check the job logs. musl-aarch64/debug / 21-librcaJob: View logs No detailed failure information available. Check the job logs. glibc-amd64/debug / 21Job: View logs No detailed failure information available. Check the job logs. glibc-amd64/debug / 25-graalJob: View logs No detailed failure information available. Check the job logs. Summary: Total: 32 | Passed: 9 | Failed: 22 | Cancelled: 1 Updated: 2026-05-13 18:59:51 UTC |
1 participant
What does this PR do?:
Wraps
Profiler::unregisterThread()+ProfiledThread::release()under a singleSignalBlockervia a newunregister_and_release()helper, closing the race window where a SIGVTALRM delivered betweenunregisterThread()returning andrelease()acquiring its internal guard would dereference a danglingProfiledThreadpointer.Motivation:
JavaThread::~JavaThread/OSThread::~OSThreadcrashed (SIGSEGV) on JDK 25 because the signal handler calledcurrentSignalSafe()in the race window above and dereferenced freed memory. PROF-14603.Additional Notes:
muse/sigsegv-in-recording). Should be retargeted tomainonce fix(profiler): line-number-table UAF, musl/aarch64 wrapper canary, and SIGVTALRM teardown race #510 merges.unregister_and_release()is__attribute__((noinline))so itsSignalBlockersigset_t does not appear in the caller's stack frame on musl/aarch64 (matching the rationale of the other noinline helpers in the same file).How to test the change?:
thread_teardown_safety_ut.cppaddsThreadTeardownSafetyTest(T-01..T-10) covering the full teardown lifecycle under signal load.test-linux-musl-aarch64andtest-linux-glibc-amd64matrices must remain green.For Datadog employees:
This PR doesn't touch any of that.
JIRA: PROF-14603