Segfault with detached threads and OpenSSL

Segfault with detached threads and OpenSSL

[Rodrigo Arias]

Hi,

(Sent to cygwin-developers by mistake).

When debugging a segfault in the Dillo browser[1] with the DNS threaded 
resolver and OpenSSL 3.0.13 I managed to isolate a reproducer.

[1]: https://github.com/dillo-browser/dillo/issues/172

It seems to be caused when both the SSL_library_init() is present and the 
PTHREAD_CREATE_DETACHED flag is set.

Steps to reproduce:

$ cat p.c
#include <pthread.h>
#include <unistd.h>
#include <stdio.h>

#include <openssl/ssl.h>

#define N 4

static void *foo(void *data)
{
         printf("hello th %d\n", (int) data);
         return NULL;
}

int main()
{
         SSL_library_init();
         pthread_t th[N];
         pthread_attr_t attr;
         pthread_attr_init(&attr);
         pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);

         for (int i = 0; i < N; i++)
                 pthread_create(&th[i], &attr, foo, (void *) i);

         sleep(5);
}

$ gcc p.c -lssl -pthread -o p

$ gdb ./p
GNU gdb (GDB) (Cygwin 13.2-1) 13.2
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-pc-cygwin".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
     <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./p...
(gdb) r
Starting program: /home/PC/dillo/build-openssl/p
[New Thread 7332.0x1f2c]
[New Thread 7332.0x99c]
[New Thread 7332.0x27d4]
[New Thread 7332.0x35e0]
[New Thread 7332.0x21dc]
[New Thread 7332.0x3170]
[New Thread 7332.0x1ea4]
[New Thread 7332.0x3180]
hello th 0
hello th 1
hello th 2
[Thread 7332.0x3170 exited with code 0]
hello th 3

Thread 6 "p" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 7332.0x21dc]
0x0000000000000000 in ?? ()

Thanks,
Rodrigo.

Re: Segfault with detached threads and OpenSSL

[jojelino]

Deter using detached attribute in cygwin. for details [1].
You might find static-linking as useful workaround for this issue which 
requires build openssl from source code.

Thread 7 "a" hit Breakpoint 9, init_thread_remove_handlers (
     handsin=handsin@entry=0x0) at crypto/initthread.c:178
178         if (!CRYPTO_THREAD_write_lock(gtr->lock))
(gdb) bt
#0  init_thread_remove_handlers (handsin=handsin@entry=0x0)
     at crypto/initthread.c:178
#1  0x00000005e03029c3 in OPENSSL_thread_stop () at crypto/initthread.c:235
#2  0x00000005e03009c3 in DllMain (hinstDLL=<optimized out>,
     fdwReason=<optimized out>, lpvReserved=<optimized out>)
     at crypto/dllmain.c:38
#3  0x00007ff976c49a1d in ntdll!RtlActivateActivationContextUnsafeFast ()
    from /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll
#4  0x00007ff976c475b6 in ntdll!LdrShutdownThread ()
    from /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll
#5  0x00007ff976c8468e in ntdll!RtlExitUserThread ()
    from /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll
#6  0x00007ff8e81ec987 in exit_thread (res=res@entry=0x0)
     at ../../.././winsup/cygwin/sigproc.cc:544
#7  0x00007ff8e81d470e in pthread::exit (this=0xa00028b90,
     value_ptr=<optimized out>) at ../../.././winsup/cygwin/thread.cc:584
#8  0x00007ff8e81d4549 in pthread::thread_init_wrapper (arg=0xa00028b90)
     at ../../.././winsup/cygwin/thread.cc:2016
#9  0x00007ff8e8174681 in pthread_wrapper (arg=<optimized out>)
     at ../../.././winsup/cygwin/create_posix_thread.cc:79
#10 pthread_wrapper (arg=<optimized out>)
     at ../../.././winsup/cygwin/create_posix_thread.cc:39


[1]
(gdb) li ../../.././winsup/cygwin/thread.cc:558
553       pthread_key::run_all_destructors ();
554
555       mutex.lock ();
556       // cleanup if thread is in detached state and not joined
557       if (equal (joiner, thread))
558         delete this;
559       else
560         {
561           valid = false;
562           return_ptr = value_ptr;

On 5/20/2024 6:29 AM, Rodrigo Arias via Cygwin wrote:
> Thread 6 "p" received signal SIGSEGV, Segmentation fault.
> [Switching to Thread 7332.0x21dc]
> 0x0000000000000000 in ?? ()