diff options
author | Vitaly Buka <vitalybuka@google.com> | 2021-04-26 12:27:29 -0700 |
---|---|---|
committer | Adhemerval Zanella <adhemerval.zanella@linaro.org> | 2021-05-14 11:36:40 -0300 |
commit | 16adc58e73f364f75e58e04bac914aac64fd0613 (patch) | |
tree | 7b39f6c41a35c7cd35f07ea5c19fbeb17df93d70 /stdlib/test-cxa_atexit-race2.c | |
parent | 7a7bcddeefdb60d0f333a60c6cff15974bf8f66b (diff) | |
download | glibc-16adc58e73f364f75e58e04bac914aac64fd0613.tar.gz glibc-16adc58e73f364f75e58e04bac914aac64fd0613.tar.xz glibc-16adc58e73f364f75e58e04bac914aac64fd0613.zip |
stdlib: Fix data race in __run_exit_handlers [BZ #27749]
Keep __exit_funcs_lock almost all the time and unlock it only to execute callbacks. This fixed two issues. 1. f->func.cxa was modified outside the lock with rare data race like: thread 0: __run_exit_handlers unlock __exit_funcs_lock thread 1: __internal_atexit locks __exit_funcs_lock thread 0: f->flavor = ef_free; thread 1: sees ef_free and use it as new thread 1: new->func.cxa.fn = (void (*) (void *, int)) func; thread 1: new->func.cxa.arg = arg; thread 1: new->flavor = ef_cxa; thread 0: cxafct = f->func.cxa.fn; // it's wrong fn! thread 0: cxafct (f->func.cxa.arg, status); // it's wrong arg! thread 0: goto restart; thread 0: call the same exit_function again as it's ef_cxa 2. Don't unlock in main while loop after *listp = cur->next. If *listp is NULL and __exit_funcs_done is false another thread may fail in __new_exitfn on assert (l != NULL): thread 0: *listp = cur->next; // It can be the last: *listp = NULL. thread 0: __libc_lock_unlock thread 1: __libc_lock_lock in __on_exit thread 1: __new_exitfn thread 1: if (__exit_funcs_done) // false: thread 0 isn't there yet. thread 1: l = *listp thread 1: moves one and crashes on assert (l != NULL); The test needs multiple iterations to consistently fail without the fix. Fixes https://sourceware.org/bugzilla/show_bug.cgi?id=27749 Checked on x86_64-linux-gnu. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Diffstat (limited to 'stdlib/test-cxa_atexit-race2.c')
-rw-r--r-- | stdlib/test-cxa_atexit-race2.c | 110 |
1 files changed, 110 insertions, 0 deletions
diff --git a/stdlib/test-cxa_atexit-race2.c b/stdlib/test-cxa_atexit-race2.c new file mode 100644 index 0000000000..be6ba9d4be --- /dev/null +++ b/stdlib/test-cxa_atexit-race2.c @@ -0,0 +1,110 @@ +/* Support file for atexit/exit, etc. race tests (BZ #27749). + Copyright (C) 2021 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + <https://www.gnu.org/licenses/>. */ + +/* The atexit/exit, at_quick_exit/quick_exit, __cxa_atexit/exit, etc. + exhibited data race while calling destructors. + + This test registers destructors from the background thread, and checks that + the same destructor is not called more than once. */ + +#include <stdatomic.h> +#include <stdio.h> +#include <stdlib.h> +#include <support/check.h> +#include <support/xthread.h> +#include <support/xunistd.h> +#include <sys/wait.h> +#include <unistd.h> + +static atomic_int registered; +static atomic_int todo = 100000; + +static void +atexit_cb (void *arg) +{ + atomic_fetch_sub (®istered, 1); + static void *prev; + if (arg == prev) + FAIL_EXIT1 ("%s: %p\n", __func__, arg); + prev = arg; + + while (atomic_load (&todo) > 0 && atomic_load (®istered) < 100) + ; +} + +int __cxa_atexit (void (*func) (void *), void *arg, void *d); + +static void * +thread_func (void *arg) +{ + void *cb_arg = NULL; + while (atomic_load (&todo) > 0) + { + if (atomic_load (®istered) < 10000) + { + int n = 10; + for (int i = 0; i < n; ++i) + __cxa_atexit (&atexit_cb, ++cb_arg, 0); + atomic_fetch_add (®istered, n); + atomic_fetch_sub (&todo, n); + } + } + + return NULL; +} + +_Noreturn static void +test_and_exit (void) +{ + pthread_attr_t attr; + + xpthread_attr_init (&attr); + xpthread_attr_setdetachstate (&attr, 1); + + xpthread_create (&attr, thread_func, NULL); + xpthread_attr_destroy (&attr); + + while (atomic_load (®istered) == 0) + ; + exit (0); +} + +static int +do_test (void) +{ + for (int i = 0; i < 20; ++i) + { + for (int i = 0; i < 10; ++i) + if (xfork () == 0) + test_and_exit (); + + for (int i = 0; i < 10; ++i) + { + int status; + xwaitpid (0, &status, 0); + if (!WIFEXITED (status)) + FAIL_EXIT1 ("Failed iterations %d", i); + TEST_COMPARE (WEXITSTATUS (status), 0); + } + } + + return 0; +} + +#define TEST_FUNCTION do_test +#include <support/test-driver.c> |