mirror of https://gitee.com/Nocallback/glibc.git
Browse Source
Keep __exit_funcs_lock almost all the time and unlock it only to execute callbacks. This fixed two issues. 1. f->func.cxa was modified outside the lock with rare data race like: thread 0: __run_exit_handlers unlock __exit_funcs_lock thread 1: __internal_atexit locks __exit_funcs_lock thread 0: f->flavor = ef_free; thread 1: sees ef_free and use it as new thread 1: new->func.cxa.fn = (void (*) (void *, int)) func; thread 1: new->func.cxa.arg = arg; thread 1: new->flavor = ef_cxa; thread 0: cxafct = f->func.cxa.fn; // it's wrong fn! thread 0: cxafct (f->func.cxa.arg, status); // it's wrong arg! thread 0: goto restart; thread 0: call the same exit_function again as it's ef_cxa 2. Don't unlock in main while loop after *listp = cur->next. If *listp is NULL and __exit_funcs_done is false another thread may fail in __new_exitfn on assert (l != NULL): thread 0: *listp = cur->next; // It can be the last: *listp = NULL. thread 0: __libc_lock_unlock thread 1: __libc_lock_lock in __on_exit thread 1: __new_exitfn thread 1: if (__exit_funcs_done) // false: thread 0 isn't there yet. thread 1: l = *listp thread 1: moves one and crashes on assert (l != NULL); The test needs multiple iterations to consistently fail without the fix. Fixes https://sourceware.org/bugzilla/show_bug.cgi?id=27749 Checked on x86_64-linux-gnu. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>codonell/c-utf8
Vitaly Buka
5 years ago
committed by
Adhemerval Zanella
Adhemerval Zanella
3 changed files with 133 additions and 17 deletions
@ -0,0 +1,110 @@ |
|||
/* Support file for atexit/exit, etc. race tests (BZ #27749).
|
|||
Copyright (C) 2021 Free Software Foundation, Inc. |
|||
This file is part of the GNU C Library. |
|||
|
|||
The GNU C Library is free software; you can redistribute it and/or |
|||
modify it under the terms of the GNU Lesser General Public |
|||
License as published by the Free Software Foundation; either |
|||
version 2.1 of the License, or (at your option) any later version. |
|||
|
|||
The GNU C Library is distributed in the hope that it will be useful, |
|||
but WITHOUT ANY WARRANTY; without even the implied warranty of |
|||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
|||
Lesser General Public License for more details. |
|||
|
|||
You should have received a copy of the GNU Lesser General Public |
|||
License along with the GNU C Library; if not, see |
|||
<https://www.gnu.org/licenses/>. */
|
|||
|
|||
/* The atexit/exit, at_quick_exit/quick_exit, __cxa_atexit/exit, etc.
|
|||
exhibited data race while calling destructors. |
|||
|
|||
This test registers destructors from the background thread, and checks that |
|||
the same destructor is not called more than once. */ |
|||
|
|||
#include <stdatomic.h> |
|||
#include <stdio.h> |
|||
#include <stdlib.h> |
|||
#include <support/check.h> |
|||
#include <support/xthread.h> |
|||
#include <support/xunistd.h> |
|||
#include <sys/wait.h> |
|||
#include <unistd.h> |
|||
|
|||
static atomic_int registered; |
|||
static atomic_int todo = 100000; |
|||
|
|||
static void |
|||
atexit_cb (void *arg) |
|||
{ |
|||
atomic_fetch_sub (®istered, 1); |
|||
static void *prev; |
|||
if (arg == prev) |
|||
FAIL_EXIT1 ("%s: %p\n", __func__, arg); |
|||
prev = arg; |
|||
|
|||
while (atomic_load (&todo) > 0 && atomic_load (®istered) < 100) |
|||
; |
|||
} |
|||
|
|||
int __cxa_atexit (void (*func) (void *), void *arg, void *d); |
|||
|
|||
static void * |
|||
thread_func (void *arg) |
|||
{ |
|||
void *cb_arg = NULL; |
|||
while (atomic_load (&todo) > 0) |
|||
{ |
|||
if (atomic_load (®istered) < 10000) |
|||
{ |
|||
int n = 10; |
|||
for (int i = 0; i < n; ++i) |
|||
__cxa_atexit (&atexit_cb, ++cb_arg, 0); |
|||
atomic_fetch_add (®istered, n); |
|||
atomic_fetch_sub (&todo, n); |
|||
} |
|||
} |
|||
|
|||
return NULL; |
|||
} |
|||
|
|||
_Noreturn static void |
|||
test_and_exit (void) |
|||
{ |
|||
pthread_attr_t attr; |
|||
|
|||
xpthread_attr_init (&attr); |
|||
xpthread_attr_setdetachstate (&attr, 1); |
|||
|
|||
xpthread_create (&attr, thread_func, NULL); |
|||
xpthread_attr_destroy (&attr); |
|||
|
|||
while (atomic_load (®istered) == 0) |
|||
; |
|||
exit (0); |
|||
} |
|||
|
|||
static int |
|||
do_test (void) |
|||
{ |
|||
for (int i = 0; i < 20; ++i) |
|||
{ |
|||
for (int i = 0; i < 10; ++i) |
|||
if (xfork () == 0) |
|||
test_and_exit (); |
|||
|
|||
for (int i = 0; i < 10; ++i) |
|||
{ |
|||
int status; |
|||
xwaitpid (0, &status, 0); |
|||
if (!WIFEXITED (status)) |
|||
FAIL_EXIT1 ("Failed iterations %d", i); |
|||
TEST_COMPARE (WEXITSTATUS (status), 0); |
|||
} |
|||
} |
|||
|
|||
return 0; |
|||
} |
|||
|
|||
#define TEST_FUNCTION do_test |
|||
#include <support/test-driver.c> |
|||
Loading…
Reference in new issue