From owner-freebsd-bugs  Tue Sep  8 05:20:08 1998
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id FAA19240
          for freebsd-bugs-outgoing; Tue, 8 Sep 1998 05:20:08 -0700 (PDT)
          (envelope-from owner-freebsd-bugs@FreeBSD.ORG)
Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id FAA19174
          for <freebsd-bugs@FreeBSD.org>; Tue, 8 Sep 1998 05:20:02 -0700 (PDT)
          (envelope-from gnats@FreeBSD.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.8.8/8.8.5) id FAA28749;
	Tue, 8 Sep 1998 05:20:01 -0700 (PDT)
Received: (from nobody@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id FAA18040;
          Tue, 8 Sep 1998 05:11:16 -0700 (PDT)
          (envelope-from nobody)
Message-Id: <199809081211.FAA18040@hub.freebsd.org>
Date: Tue, 8 Sep 1998 05:11:16 -0700 (PDT)
From: info@highwind.com
To: freebsd-gnats-submit@FreeBSD.ORG
X-Send-Pr-Version: www-1.0
Subject: bin/7863: libc_r calls free() while in a signal handler
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


>Number:         7863
>Category:       bin
>Synopsis:       libc_r calls free() while in a signal handler
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Sep  8 05:20:01 PDT 1998
>Last-Modified:
>Originator:     Robert M. Fleischman
>Organization:
HighWind Software, Inc.
>Release:        3.0 Current
>Environment:
FreeBSD zonda.highwind.com 3.0-19980831-SNAP FreeBSD 3.0-19980831-SNAP #0: Mon Aug 31 14:03:19 GMT 1998     root@make.ican.net:/usr/src/sys/compile/GENERIC  i386

>Description:
libc_r calls free() while in a signal handler. This is very *BAD*.
malloc()/free() should NOT be called from within a signal handler.

Code path is as follows:
	SIGVTALRM goes off and is caught by _thread_sig_handler()
	_thread_sig_handler() calls _thread_kern_sched()
	_thread_kern_sched() calls free()
>How-To-Repeat:
This is a timing issue. However, given the code path I outlined earlier,
the sequence is quite possible.
>Fix:

>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message