Bug 496201

Created attachment 339968 [details]
patch

< Top information >
 PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                    
18221 nscd      16   0  108m  99m  99m S 98.0  1.6   2035:37 nscd                                                                       
16177 root      15   0  3160  952  684 R  2.0  0.0   0:00.01 top                                                                        
   1 root      16   0  3064  592  508 S  0.0  0.0   0:02.10 init                                                                       


pthread_cond_timedwait() may return EINVAL if given timespec is invalid.
Please see the mark *2 in the after-mentioned source code(pthread_cond_timedwait.c).
Actually the core showed that EINVAL was returned.

However, for such case, nscd_run() just retries pthread_cond_timedwait() with
the same timespec and fall downto he infinite loop if readylist is NULL.
Please see the mark *1 in the after-mentioned source code(connections.c).

I uploaded the patch that recalculates timespec for pthread_cond_timedwait()
when it returns EINVAL.
Could you review this patch and incorporate it?

------------------------------------------------
nscd/connections.c
------------------------------------------------
/* This is the main loop.  It is replicated in different threads but the
  `poll' call makes sure only one thread handles an incoming connection.  */
static void *
__attribute__ ((__noreturn__))
nscd_run (void *p)
{
 const long int my_number = (long int) p;
 const int run_prune = my_number < lastdb && dbs[my_number].enabled;
 struct timespec prune_ts;
 int to = 0;
 char buf[256];

 if (run_prune)
   {
     setup_thread (&dbs[my_number]);

     /* We are running.  */
     dbs[my_number].head->timestamp = time (NULL);

     if (clock_gettime (timeout_clock, &prune_ts) == -1)
       /* Should never happen.  */
       abort ();

     /* Compute timeout time.  */
     prune_ts.tv_sec += CACHE_PRUNE_INTERVAL;
   }

 /* Initial locking.  */
 pthread_mutex_lock (&readylist_lock);

 /* One more thread available.  */
 ++nready;

 while (1)
   {
     while (readylist == NULL)
       {
         if (run_prune)
           {
             /* Wait, but not forever.  */
             to = pthread_cond_timedwait (&readylist_cond, &readylist_lock,
                                          &prune_ts);

             /* If we were woken and there is no work to be done,
                just start pruning.  */
             if (readylist == NULL && to == ETIMEDOUT)   <<####### (*1)
               {
                 --nready;

                 if (sighup_pending)
                   goto sighup_prune;

                 pthread_mutex_unlock (&readylist_lock);
                 goto only_prune;
               }
           }
         else
           /* No need to timeout.  */
           pthread_cond_wait (&readylist_cond, &readylist_lock);
       }

     if (sighup_pending)
       {
  :
< SNIP >
  :

------------------------------------------------
nptl/sysdeps/pthread/pthread_cond_timedwait.c
------------------------------------------------

int
__pthread_cond_timedwait (cond, mutex, abstime)
    pthread_cond_t *cond;
    pthread_mutex_t *mutex;
    const struct timespec *abstime;
{
 struct _pthread_cleanup_buffer buffer;
 struct _condvar_cleanup_buffer cbuffer;
 int result = 0;

 /* Catch invalid parameters.  */
 if (abstime->tv_nsec < 0 || abstime->tv_nsec >= 1000000000)
   return EINVAL;   <<###### (*2)
 :
< SNIP >
 :

How reproducible:
Unknown.

Steps to Reproduce:
There is no way to reproduce. However, the same condition can be caused with gbd command as follows.
1. Stop at the front of pthread_cond_timedwait().
2. Change tv_nsec to 1000000000.
3. Continue gdb processing.

Actual results:
Nscd consumes cpu resources due to infinite loop.