Bug 555858

Created attachment 384683 [details]
reproducer

The race condition is in setresuid(), which in glibc tries to be
 smart about threads and change the euid of threads when the euid of
 the main program changes. The problem is that this makes setresuid()
 non-atomic, which means that if an IO completes during the complex
 series of system calls that setresuid() becomes, then the thread
 completing the IO may get -1/EPERM back from the rt_sigqueueinfo()
 call that it uses to notify its parent of the completing IO. In that
 case two things happen:

   1) the signal is never delivered, so the caller never is told that
   the IO has completed

   2) if the caller polls for completion using aio_error() then it
   will see a -1/EPERM result, rather than the real result of the IO

How reproducible:
use the attached tool

Steps to Reproduce:
# gcc -o aio_uid -lrt aio_uid.c
[root]# ./aio_uid /tmp/foo
Timed out waiting for IO (AIO race)

Actual results:
tool fails

Expected results:
tool runs w/o stopping with an error
as when using setreuid() instead of setresuid()
# gcc -o aio_uid -lrt aio_uid.c -DUSE_SETREUID
# ./aio_uid /tmp/foo
.... runs for a while w/o errors

Additional info:
more comments are in the header of the tool