From 614cd66e7e9b7323dd67bf208fda9abf296721b4 Mon Sep 17 00:00:00 2001 From: Brandon Black Date: Mon, 30 Mar 2026 06:56:14 -0500 Subject: [PATCH] LinuxThreadImpl: clear tidptr during detached exit Fixes: #31714 --- lib/std/Thread.zig | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lib/std/Thread.zig b/lib/std/Thread.zig index 68510cf5b1ddfca7cb342639bf8f8163e032343e..6be9f06f779bd88664e1b2a55e54c5a90dc06932 100644 --- a/lib/std/Thread.zig +++ b/lib/std/Thread.zig @@ -1147,6 +1147,11 @@ const LinuxThreadImpl = struct { /// Ported over from musl libc's pthread detached implementation: /// https://github.com/ifduyue/musl/search?q=__unmapself fn freeAndExit(self: *ThreadCompletion) noreturn { + // If we do not reset the child_tidptr to null here, the kernel would later write the + // value zero to that address, which is inside the block we're unmapping below, after + // our thread exits. This can sometimes corrupt memory in other mmap blocks from + // unrelated concurrent threads. + _ = linux.set_tid_address(null); // If a signal were delivered between SYS_munmap and SYS_exit, any installed signal // handler would immediately segfault due to the stack being unmapped. To avoid this, // we need to mask all signals before entering the inline asm. -- 2.54.0