public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/3429] New: Race in _dl_open with r_debug.r_state consistency check
@ 2006-10-27 17:31 suzuki at in dot ibm dot com
  2006-10-27 17:32 ` [Bug libc/3429] " suzuki at in dot ibm dot com
                   ` (7 more replies)
  0 siblings, 8 replies; 9+ messages in thread
From: suzuki at in dot ibm dot com @ 2006-10-27 17:31 UTC (permalink / raw)
  To: glibc-bugs

While running some stress tests on one of our application, we encountered an
assert() in ld.so as follows:

"Inconsistency detected by ld.so: dl-open.c: 610: _dl_open: Assertion
`_dl_debug_initialize (0, args.nsid)->r_state == RT_CONSISTENT' failed!

with glibc-2.4.31. This race seems to be present in the libc I got from the CVS
[at code inspection]. We were able to reproduce this consistently within 4-5hrs
of run.

Upon debugging we found that it is due to a race between two threads doing a
_dl_open().

The scenario is something like this :

In elf/dl-open.c, _dl_open:


  /* Make sure we are alone.  */
  __rtld_lock_lock_recursive (GL(dl_load_lock));

[...]

  int errcode = _dl_catch_error (&objname, &errstring, &malloced,
                                 dl_open_worker, &args);
#ifndef MAP_COPY
  /* We must munmap() the cache file.  */
  _dl_unload_cache ();
#endif

  /* Release the lock.  */
  __rtld_lock_unlock_recursive (GL(dl_load_lock));

^^^^^ This would kick any other thread waiting on the lock.


if (__builtin_expect (errstring != NULL, 0))
  {
     [...]
   assert (_dl_debug_initialize (0, args.nsid)->r_state == RT_CONSISTENT);
  }

assert (_dl_debug_initialize (0, args.nsid)->r_state == RT_CONSISTENT);

And, if the thread which gets woken up is playing with the same namespace, and
sets the r_state to RT_ADD in _dl_map_object_from_fd even before we reach here
(truly possible in an SMP system),  ( due to getting scheduled out ), we would
hit the assert !

So, it is not safe to believe that the r_state won't get changed once we release
the lock.

-- 
           Summary: Race in _dl_open with r_debug.r_state consistency check
           Product: glibc
           Version: 2.4
            Status: NEW
          Severity: normal
          Priority: P1
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: suzuki at in dot ibm dot com
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=3429

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.


^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2009-07-24  1:52 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2006-10-27 17:31 [Bug libc/3429] New: Race in _dl_open with r_debug.r_state consistency check suzuki at in dot ibm dot com
2006-10-27 17:32 ` [Bug libc/3429] " suzuki at in dot ibm dot com
2006-10-27 17:40 ` suzuki at in dot ibm dot com
2006-10-27 18:18 ` suzuki at in dot ibm dot com
2006-10-27 18:44 ` drepper at redhat dot com
2006-10-27 18:51 ` suzuki at in dot ibm dot com
2007-01-12 15:21 ` cvs-commit at gcc dot gnu dot org
2009-07-24  1:48 ` radford at blackbean dot org
2009-07-24  1:52 ` drepper at redhat dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).