Some kind of semi-workaround patch attached. It seems to leave this kind of race window for me (for select which is worse):
0x000000006004bf98 <+136>: xor %r8d,%r8d 0x000000006004bf9b <+139>: test %eax,%eax 0x000000006004bf9d <+141>: jne 0x6004c2b7 <do_select+935> 0x000000006004bfa3 <+147>: mov 0x20(%rsp),%r14 0x000000006004bfa8 <+152>: mov 0x246d8(%r14),%esi 0x000000006004bfaf <+159>: test %esi,%esi 0x000000006004bfb1 <+161>: je 0x6004bfb8 <do_select+168> 0x000000006004bfb3 <+163>: lea 0x40(%rsp),%r8 0x000000006004bfb8 <+168>: mov 0x28(%rsp),%rdx 0x000000006004bfbd <+173>: mov %r11,%rsi 0x000000006004bfc0 <+176>: mov %ebx,%edi 0x000000006004bfc2 <+178>: callq 0x6012df90 <select>
I think it could still be narrowed some, but this makes it unlikely enough for me for time being...
Some kind of semi-workaround patch attached. It seems to leave this kind of race window for me (for select which is worse):
0x0000000060 04bf98 <+136>: xor %r8d,%r8d 04bf9b <+139>: test %eax,%eax 04bf9d <+141>: jne 0x6004c2b7 <do_select+935> 04bfa3 <+147>: mov 0x20(%rsp),%r14 04bfa8 <+152>: mov 0x246d8(%r14),%esi 04bfaf <+159>: test %esi,%esi 04bfb1 <+161>: je 0x6004bfb8 <do_select+168> 04bfb3 <+163>: lea 0x40(%rsp),%r8 04bfb8 <+168>: mov 0x28(%rsp),%rdx 04bfbd <+173>: mov %r11,%rsi 04bfc0 <+176>: mov %ebx,%edi 04bfc2 <+178>: callq 0x6012df90 <select>
0x0000000060
0x0000000060
0x0000000060
0x0000000060
0x0000000060
0x0000000060
0x0000000060
0x0000000060
0x0000000060
0x0000000060
0x0000000060
I think it could still be narrowed some, but this makes it unlikely enough for me for time being...