How a thread can commit suicide with syscall only in C Linux - c

Question

I wrote the following code, the goal is to make thread to suicide with syscall (without calling pthread_exit()).
So I create two threads and select one that get its thread id, and send SIGKILL to itself with tkill()
The problem is that all the process terminates, not only the selected thread.
Why is that? How can I makes thread to suicide with syscall only?
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <pthread.h>
#include <sys/syscall.h>
void *myThreadFun(void *vargp)
{
int tid = syscall(SYS_gettid);
if(tid %2 ==0)
{
printf("kill thread id ! = %ld \n",tid);
syscall(SYS_tkill,tid,9);
}
while(1)
{
printf("Thread ID: %d\n", tid);
sleep(2);
}
}
int main()
{
int i;
pthread_t tid;
printf("main thread id = %ld \n",syscall(SYS_gettid));
for (i = 0; i < 2; i++)
pthread_create(&tid, NULL, myThreadFun, NULL);
char tmp;
scanf("%c",&tmp);
return 0;
}
output:
main thread id = 11911
kill thread id ! = 11912
Killed

Answer 1

There is no "kill this thread only" signal disposition; there are only "ignore", "terminate the entire process", "terminate the entire process and dump a core file", "stop (pause) the entire process", and "continue the entire process if it is stopped (paused)". You cannot even choose the disposition per se; only between the default disposition for that particular signal, "ignore", or an userspace signal handler function.
There is really only one option: the SYS_exit syscall.
In C, you can do this via
#include <unistd.h>
#include <sys/syscall.h>
static inline void exit_thread(void) __attribute__((noreturn));
static inline void exit_thread(void)
{
syscall(SYS_exit, 0);
}
A real-world example always beats a snippet, I think. Consider the following program:
#include <stdlib.h>
#include <stdint.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <pthread.h>
#include <string.h>
#include <stdio.h>
#include <errno.h>
void *thread_function(void *payload)
{
#ifdef DO_EXIT
const int exit_code = (int)(intptr_t)payload;
fprintf(stderr, "Running thread_function(%p); calling syscall(SYS_exit, %d).\n", payload, exit_code);
fflush(stderr);
syscall(SYS_exit, exit_code);
#else
fprintf(stderr, "Running thread_function(%p); calling pthread_exit(%p).\n", payload, payload);
fflush(stderr);
pthread_exit(payload);
#endif
return NULL; /* Never reached */
}
int main(void)
{
void *const payload = thread_function; /* Just some random pointer value */
pthread_t thread_id;
void *thread_status;
int err;
printf("Calling pthread_create(&thread_id, NULL, thread_function, %p): ", payload);
fflush(stdout);
err = pthread_create(&thread_id, NULL, thread_function, payload);
if (err) {
printf("Failed: %s.\n", strerror(errno));
return EXIT_FAILURE;
}
printf("Success.\n");
printf("Calling pthread_join(thread_id, &thread_status): ");
fflush(stdout);
err = pthread_join(thread_id, &thread_status);
if (err) {
printf("Failed: %s.\n", strerror(errno));
return EXIT_FAILURE;
}
printf("Success; thread_status == %p.\n", thread_status);
return EXIT_SUCCESS;
}
Save it as example.c, then compile one version, ex1, that uses pthread_exit():
gcc -Wall -Wextra -O2 example.c -pthread -o ex1
and another, ex2, that uses syscall(SYS_exit,):
gcc -Wall -Wextra -DDO_EXIT -O2 example.c -pthread -o ex2
To see exactly what is happening, run each example under strace, logging each clone, write, futex, exit, and exit_group syscalls the program makes:
strace -f -e clone,write,futex,exit,exit_group -o ex1.log ./ex1
strace -f -e clone,write,futex,exit,exit_group -o ex2.log ./ex2
On my machine, ex1.log looks like
28703 write(1, "Calling pthread_create(&thread_i"..., 75) = 75
28703 clone(child_stack=0x7f11f9c14fb0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tidptr=0x7f11f9c159d0, tls=0x7f11f9c15700, child_tidptr=0x7f11f9c159d0) = 28704
28703 write(1, "Success.\n", 9) = 9
28703 write(1, "Calling pthread_join(thread_id, "..., 49) = 49
28703 futex(0x7f11f9c159d0, FUTEX_WAIT, 28704, NULL <unfinished ...>
28704 write(2, "Running thread_function(0x563f0c"..., 79) = 79
28704 futex(0x7f11f94141a0, FUTEX_WAKE_PRIVATE, 2147483647) = 0
28704 exit(0) = ?
28703 <... futex resumed> ) = 0
28704 +++ exited with 0 +++
28703 write(1, "Success; thread_status == 0x563f"..., 42) = 42
28703 exit_group(0) = ?
28703 +++ exited with 0 +++
and ex2.log looks like
28707 write(1, "Calling pthread_create(&thread_i"..., 75) = 75
28707 clone(child_stack=0x7f42c7db8fb0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tidptr=0x7f42c7db99d0, tls=0x7f42c7db9700, child_tidptr=0x7f42c7db99d0) = 28708
28707 write(1, "Success.\n", 9) = 9
28708 write(2, "Running thread_function(0x556b57"..., 80 <unfinished ...>
28707 write(1, "Calling pthread_join(thread_id, "..., 49 <unfinished ...>
28708 <... write resumed> ) = 80
28707 <... write resumed> ) = 49
28708 exit(1472596720 <unfinished ...>
28707 futex(0x7f42c7db99d0, FUTEX_WAIT, 28708, NULL <unfinished ...>
28708 <... exit resumed>) = ?
28707 <... futex resumed> ) = 0
28708 +++ exited with 240 +++
28707 write(1, "Success; thread_status == (nil)."..., 33) = 33
28707 exit_group(0) = ?
28707 +++ exited with 0 +++
From their differences, and the fact that this is GNU C library version 2.27 running on x86-64 architecture, we can make a couple of important observations:
The GNU pthreads implementation uses a futex to pass the thread function return value, when the thread exits and is reaped (using pthread_join()) by another thread.
Aside from the futex used to pass the return value, pthread_exit() calls the exit syscall with exit status 0.
(In fact, the man 3 pthread_exit man page says so explicitly.)
When the thread exits (using the exit syscall), the exit status code is irrelevant.
If our thread function uses the syscall directly, cleanup functions registered by atexit() and pthread_push() will not be called, and if pthread_join() is called on this thread, the return value will essentially be (void *)0 (== NULL in Linux, printed as (nil) by printf()/fprintf() %p format specifier).