diff options
| author | Vitaly Buka <vitalybuka@google.com> | 2021-04-26 12:27:29 -0700 |
|---|---|---|
| committer | Adhemerval Zanella <adhemerval.zanella@linaro.org> | 2021-05-14 11:36:40 -0300 |
| commit | 16adc58e73f364f75e58e04bac914aac64fd0613 (patch) | |
| tree | 7b39f6c41a35c7cd35f07ea5c19fbeb17df93d70 /stdlib/Makefile | |
| parent | 7a7bcddeefdb60d0f333a60c6cff15974bf8f66b (diff) | |
| download | glibc-16adc58e73f364f75e58e04bac914aac64fd0613.zip glibc-16adc58e73f364f75e58e04bac914aac64fd0613.tar.gz glibc-16adc58e73f364f75e58e04bac914aac64fd0613.tar.bz2 | |
stdlib: Fix data race in __run_exit_handlers [BZ #27749]
Keep __exit_funcs_lock almost all the time and unlock it only to execute
callbacks. This fixed two issues.
1. f->func.cxa was modified outside the lock with rare data race like:
thread 0: __run_exit_handlers unlock __exit_funcs_lock
thread 1: __internal_atexit locks __exit_funcs_lock
thread 0: f->flavor = ef_free;
thread 1: sees ef_free and use it as new
thread 1: new->func.cxa.fn = (void (*) (void *, int)) func;
thread 1: new->func.cxa.arg = arg;
thread 1: new->flavor = ef_cxa;
thread 0: cxafct = f->func.cxa.fn; // it's wrong fn!
thread 0: cxafct (f->func.cxa.arg, status); // it's wrong arg!
thread 0: goto restart;
thread 0: call the same exit_function again as it's ef_cxa
2. Don't unlock in main while loop after *listp = cur->next. If *listp
is NULL and __exit_funcs_done is false another thread may fail in
__new_exitfn on assert (l != NULL):
thread 0: *listp = cur->next; // It can be the last: *listp = NULL.
thread 0: __libc_lock_unlock
thread 1: __libc_lock_lock in __on_exit
thread 1: __new_exitfn
thread 1: if (__exit_funcs_done) // false: thread 0 isn't there yet.
thread 1: l = *listp
thread 1: moves one and crashes on assert (l != NULL);
The test needs multiple iterations to consistently fail without the fix.
Fixes https://sourceware.org/bugzilla/show_bug.cgi?id=27749
Checked on x86_64-linux-gnu.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Diffstat (limited to 'stdlib/Makefile')
| -rw-r--r-- | stdlib/Makefile | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/stdlib/Makefile b/stdlib/Makefile index b3b30ab..f5755a1 100644 --- a/stdlib/Makefile +++ b/stdlib/Makefile @@ -81,7 +81,8 @@ tests := tst-strtol tst-strtod testmb testrand testsort testdiv \ tst-width-stdint tst-strfrom tst-strfrom-locale \ tst-getrandom tst-atexit tst-at_quick_exit \ tst-cxa_atexit tst-on_exit test-atexit-race \ - test-at_quick_exit-race test-cxa_atexit-race \ + test-at_quick_exit-race test-cxa_atexit-race \ + test-cxa_atexit-race2 \ test-on_exit-race test-dlclose-exit-race \ tst-makecontext-align test-bz22786 tst-strtod-nan-sign \ tst-swapcontext1 tst-setcontext4 tst-setcontext5 \ @@ -100,6 +101,7 @@ endif LDLIBS-test-atexit-race = $(shared-thread-library) LDLIBS-test-at_quick_exit-race = $(shared-thread-library) LDLIBS-test-cxa_atexit-race = $(shared-thread-library) +LDLIBS-test-cxa_atexit-race2 = $(shared-thread-library) LDLIBS-test-on_exit-race = $(shared-thread-library) LDLIBS-tst-canon-bz26341 = $(shared-thread-library) |