Question

According to this, pthread_join sets the output parameter **thread_return to pd->result, then frees pd. Is this okay and I am missing something, or is there a serious bug in glibc?

    /* We mark the thread as terminated and as joined.  */
    pd->tid = -1;

    /* Store the return value if the caller is interested.  */
    if (thread_return != NULL)
      *thread_return = pd->result;


    /* Free the TCB.  */
    __free_tcb (pd);

Answer 1

__free_tbc does not free pd, but the thread’s stack, ie pd->tpp (see also here). So pd->result still a valid pointer after these statements.