2010-03-09  Ulrich Drepper  <drepper@redhat.com>

	* pthread_create.c (__pthread_create_2_1): If priorities are incorrect
	and the call fails wake eventually waiting setxid threads.  Don't free
	stack here if we try starting a thread.
	* sysdeps/pthread/createthread.c (do_clone): Only wake setxid waiter
	if the clone call failed.

2010-03-08  Andreas Schwab  <schwab@redhat.com>

	* pthread_create.c (__pthread_create_2_1): Don't set setxid_futex.
	* allocatestack.c (get_cached_stack): Set setxid_futex.
	(allocate_stack): Likewise.

2010-03-05  Andreas Schwab  <schwab@redhat.com>
	    Ulrich Drepper  <drepper@redhat.com>

	* allocatestack.c (setxid_mark_thread): Delay handling of thread if
	it is creating a thread or it is just being created.
	* pthread_create.c (start_thread): Wake setxid thread if it is
	waiting.
	(__pthread_create_2_1): Initialize setxid_futex.
	* sysdeps/pthread/createthread.c (do_clone): Wake setxid thread if it
	is waiting.

Index: glibc-2.5-20061008T1257/nptl/allocatestack.c
===================================================================
--- glibc-2.5-20061008T1257.orig/nptl/allocatestack.c
+++ glibc-2.5-20061008T1257/nptl/allocatestack.c
@@ -213,6 +213,9 @@ get_cached_stack (size_t *sizep, void **
       return NULL;
     }
 
+  /* Don't allow setxid until cloned.  */
+  result->setxid_futex = -1;
+
   /* Dequeue the entry.  */
   stack_list_del (&result->list);
 
@@ -421,6 +424,9 @@ allocate_stack (const struct pthread_att
       /* The process ID is also the same as that of the caller.  */
       pd->pid = THREAD_GETMEM (THREAD_SELF, pid);
 
+      /* Don't allow setxid until cloned.  */
+      pd->setxid_futex = -1;
+
       /* Allocate the DTV for this thread.  */
       if (_dl_allocate_tls (TLS_TPADJ (pd)) == NULL)
 	{
@@ -558,6 +564,9 @@ allocate_stack (const struct pthread_att
 	  THREAD_SYSINFO(pd) = THREAD_SELF_SYSINFO;
 #endif
 
+	  /* Don't allow setxid until cloned.  */
+	  pd->setxid_futex = -1;
+
 	  /* The process ID is also the same as that of the caller.  */
 	  pd->pid = THREAD_GETMEM (THREAD_SELF, pid);
 
@@ -944,6 +953,13 @@ setxid_mark_thread (struct xid_command *
 {
   int ch;
 
+  /* Wait until this thread is cloned.  */
+  if (t->setxid_futex == -1
+      && ! atomic_compare_and_exchange_bool_acq (&t->setxid_futex, -2, -1))
+    do
+      lll_futex_wait (&t->setxid_futex, -2, LLL_PRIVATE);
+    while (t->setxid_futex == -2);
+
   /* Don't let the thread exit before the setxid handler runs.  */
   t->setxid_futex = 0;
 
Index: glibc-2.5-20061008T1257/nptl/pthread_create.c
===================================================================
--- glibc-2.5-20061008T1257.orig/nptl/pthread_create.c
+++ glibc-2.5-20061008T1257/nptl/pthread_create.c
@@ -239,6 +239,10 @@ start_thread (void *arg)
   /* Initialize resolver state pointer.  */
   __resp = &pd->res;
 
+  /* Allow setxid from now onwards.  */
+  if (__builtin_expect (atomic_exchange_acq (&pd->setxid_futex, 0) == -2, 0))
+    lll_futex_wake (&pd->setxid_futex, 1, LLL_PRIVATE);
+
 #ifdef __NR_set_robust_list
 # ifndef __ASSUME_SET_ROBUST_LIST
   if (__set_robust_list_avail >= 0)
@@ -520,33 +524,23 @@ __pthread_create_2_1 (newthread, attr, s
       if (pd->schedparam.sched_priority < minprio
 	  || pd->schedparam.sched_priority > maxprio)
 	{
-	  err = EINVAL;
-	  goto errout;
+	  /* Perhaps a thread wants to change the IDs and if waiting
+	     for this stillborn thread.  */
+	  if (__builtin_expect (atomic_exchange_acq (&pd->setxid_futex, 0)
+				== -2, 0))
+	    lll_futex_wake (&pd->setxid_futex, 1, LLL_PRIVATE);
+
+	  __deallocate_stack (pd);
+
+	  return EINVAL;
 	}
     }
 
   /* Pass the descriptor to the caller.  */
   *newthread = (pthread_t) pd;
 
-  /* Remember whether the thread is detached or not.  In case of an
-     error we have to free the stacks of non-detached stillborn
-     threads.  */
-  bool is_detached = IS_DETACHED (pd);
-
   /* Start the thread.  */
-  err = create_thread (pd, iattr, STACK_VARIABLES_ARGS);
-  if (err != 0)
-    {
-      /* Something went wrong.  Free the resources.  */
-      if (!is_detached)
-	{
-	errout:
-	  __deallocate_stack (pd);
-	}
-      return err;
-    }
-
-  return 0;
+  return create_thread (pd, iattr, STACK_VARIABLES_ARGS);
 }
 versioned_symbol (libpthread, __pthread_create_2_1, pthread_create, GLIBC_2_1);
 
Index: glibc-2.5-20061008T1257/nptl/sysdeps/pthread/createthread.c
===================================================================
--- glibc-2.5-20061008T1257.orig/nptl/sysdeps/pthread/createthread.c
+++ glibc-2.5-20061008T1257/nptl/sysdeps/pthread/createthread.c
@@ -72,16 +72,20 @@ do_clone (struct pthread *pd, const stru
      that cares whether the thread count is correct.  */
   atomic_increment (&__nptl_nthreads);
 
-  if (ARCH_CLONE (fct, STACK_VARIABLES_ARGS, clone_flags,
-		  pd, &pd->tid, TLS_VALUE, &pd->tid) == -1)
+  int rc = ARCH_CLONE (fct, STACK_VARIABLES_ARGS, clone_flags,
+		       pd, &pd->tid, TLS_VALUE, &pd->tid);
+
+  if (__builtin_expect (rc == -1, 0))
     {
       atomic_decrement (&__nptl_nthreads); /* Oops, we lied for a second.  */
 
-      /* Failed.  If the thread is detached, remove the TCB here since
-	 the caller cannot do this.  The caller remembered the thread
-	 as detached and cannot reverify that it is not since it must
-	 not access the thread descriptor again.  */
-      if (IS_DETACHED (pd))
+      /* Perhaps a thread wants to change the IDs and if waiting
+	 for this stillborn thread.  */
+      if (__builtin_expect (atomic_exchange_acq (&pd->setxid_futex, 0)
+			    == -2, 0))
+	lll_futex_wake (&pd->setxid_futex, 1, LLL_PRIVATE);
+
+      /* Free the resources.  */
 	__deallocate_stack (pd);
 
       return errno;
@@ -113,6 +117,9 @@ do_clone (struct pthread *pd, const stru
 	      (void) INTERNAL_SYSCALL (tkill, err2, 2, pd->tid, SIGCANCEL);
 #endif
 
+	      /* We do not free the stack here because the canceled thread
+		 itself will do this.  */
+
 	      return (INTERNAL_SYSCALL_ERROR_P (res, err)
 		      ? INTERNAL_SYSCALL_ERRNO (res, err)
 		      : 0);