[Bug libc/13271] New: getaddrinfo is not thread safe

[Bug libc/13271] New: getaddrinfo is not thread safe

[mol at astron dot nl]

http://sourceware.org/bugzilla/show_bug.cgi?id=13271

             Bug #: 13271
           Summary: getaddrinfo is not thread safe
           Product: glibc
           Version: 2.14
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: mol@astron.nl
    Classification: Unclassified


The getaddrinfo() can trigger the following sequence of function calls:

getaddrinfo()
gaih_inet()
__gethostbyname2_r()
_nss_dns_gethostbyname2_r()
_nss_dns_gethostbyname3_r()
__res_hostalias()
getenv("HOSTALIASES")

The getenv() function is not thread-safe however, so getaddrinfo() should not
call it. I suspect other getenv() functions can be reached as well, but I lack
enough glibc knowledge to provide a good list so I won't try.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[bugdal at aerifal dot cx]

http://sourceware.org/bugzilla/show_bug.cgi?id=13271

Rich Felker <bugdal at aerifal dot cx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bugdal at aerifal dot cx

--- Comment #1 from Rich Felker <bugdal at aerifal dot cx> 2011-10-07 12:28:26 UTC ---
Not a bug, as far as I can tell.

2.9.1 Thread-Safety

Since multi-threaded applications are not allowed to use the environ variable
to access or modify any environment variable while any other thread is
concurrently modifying any environment variable, any function dependent on any
environment variable is not thread-safe if another thread is modifying the
environment; see XSH exec.

And the cross-referenced text (from exec):

Conforming multi-threaded applications shall not use the environ variable to
access or modify any environment variable while any other thread is
concurrently modifying any environment variable. A call to any function
dependent on any environment variable shall be considered a use of the environ
variable to access that environment variable.

The only way the issue you reported *may* be a bug is in that getaddrinfo is
not documented by the standard to use any environment variables; this is a
behavior specific to most implementations including glibc. I'm not sure how
cases like this should be treated, but I think as long as the implementation
documents the use of the environment it's probably technically okay..

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13271

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #2 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-10-07 14:43:02 UTC ---
As soon as multiple threads are in use a program must not modify the
environment and therefore calls to getenv are safe.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[mol at astron dot nl]

http://sourceware.org/bugzilla/show_bug.cgi?id=13271

--- Comment #3 from Jan David Mol <mol at astron dot nl> 2011-10-07 14:56:17 UTC ---
According to section 2.9.1 you quote, a program is still thread safe if it
writes environment variables, and thus allows setenv(), it just can't read them
at the same time. Thus the issue arises that getaddrinfo is not thread-safe
under some circumstances, i.e. when there is no concurrent use of setenv() and
friends. This violates the POSIX requirements for getaddrinfo:

The freeaddrinfo() and getaddrinfo() functions shall be thread-safe.

I don't see any exceptions being noted or any access to environment variables
being mentioned?

@Ulrich: where does it state that concurrent threads cannot modify the
environment at all? Section 2.9.1 seems to directly contradict that statement. 
In fact, the glibc documentation does not provide any hint towards the fact
that getaddrinfo will clash with setenv, nor does it forbid the use of setenv
in multithreaded programs as you seem to imply.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[bugdal at aerifal dot cx]

http://sourceware.org/bugzilla/show_bug.cgi?id=13271

--- Comment #4 from Rich Felker <bugdal at aerifal dot cx> 2011-10-07 16:29:26 UTC ---
2.9.1 states very explicitly, "any function dependent on any
environment variable is not thread-safe if another thread is modifying the
environment". The only potential wiggle-room to claim that glibc is
non-conformant is that getaddrinfo is not documented (by the standard or by the
implementation) as depending on the environment.

With that said, I agree that Ulrich Drepper is wrong to claim that modifying
the environment in a multi-threaded program is not allowed. It can be done
safely in many situations, such as when all but one thread is purely
computational or only invoking only async-signal-safe functions. It should also
be perfectly safe if you modify extern char **environ; (or the array it points
to) directly in only atomic ways and don't clobber any environment memory that
other threads could still be referencing.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[mol at astron dot nl]

http://sourceware.org/bugzilla/show_bug.cgi?id=13271

--- Comment #5 from Jan David Mol <mol at astron dot nl> 2011-10-07 17:49:35 UTC ---
The reason I report this is because I saw my application crash repeatedly in a
validly used getaddrinfo, because another thread invalidated environ through
setenv. I've since replaced the setenv call, but what worries me is that
nothing in the documentation of glibc or POSIX could have indicated for me that
this could happen.

Although I personally would consider a function only thread safe if no valid
use can cause undefined behaviour due to multithreaded use, I do recognise that
in this case practicality is important to consider. After all, dropping support
for the environment variables used in getaddrinfo and other functions, or
wrapping getenv with the same lock that setenv already has, might not be
desirable either.

Since you are the devs and not me, it is up to you, but I kindly request that
you reopen this bug as a documentation one at least. The setenv man page family
could carry a warning indicating that it makes the behaviour of concurrently
running thread-safe (glibc) functions undefined?

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[bugdal at aerifal dot cx]

http://sourceware.org/bugzilla/show_bug.cgi?id=13271

--- Comment #6 from Rich Felker <bugdal at aerifal dot cx> 2011-10-07 18:52:26 UTC ---
I think a reasonable solution that would definitely be conformant would be for
getenv and functions documented *by the standard* as depending on the
environment to remain as-is, and not perform any locking, but for getaddrinfo
and any other functions that use the environment but aren't documented by the
standard as doing so to obtain the environment lock before using getenv. Adding
locking to getaddrinfo would be a tiny cost anyway in comparison to all the
syscalls involved in performing a DNS lookup..

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[mol at astron dot nl]

http://sourceware.org/bugzilla/show_bug.cgi?id=13271

Jan David Mol <mol at astron dot nl> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|INVALID                     |

--- Comment #7 from Jan David Mol <mol at astron dot nl> 2011-10-12 08:21:10 UTC ---
Reopened; this ticket cannot be regarded as 'invalid', nor 'resolved', because,
as mentioned earlier, POSIX and glibc docs do allow setenv and getaddrinfo to
run concurrently.

Rich Felker's idea of wrapping all getenv calls inside glibc is good, assuming
the number of functions needing access to that global lock is limited. Getenv
itself needs only very weak (in fact, insanely weak) guarantees by POSIX, so
indeed that doesn't need change.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13271

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #8 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-10-15 13:58:25 UTC ---
I've already explained that multi-threaded programs are not allowed to modify
the environment.  Stop reopening and educate yourself.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[bugdal at aerifal dot cx]

http://sourceware.org/bugzilla/show_bug.cgi?id=13271

Rich Felker <bugdal at aerifal dot cx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |

--- Comment #9 from Rich Felker <bugdal at aerifal dot cx> 2011-10-15 20:55:55 UTC ---
Please educate yourself:

http://pubs.opengroup.org/onlinepubs/9699919799/functions/V2_chap02.html#tag_15_09_01
http://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13271

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #10 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-10-15 22:42:53 UTC ---
(In reply to comment #9)
> Please educate yourself:

Just go away, you really know nothing.  Guess who of the two of us is in the
POSIX committee?

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[bugdal at aerifal dot cx]

http://sourceware.org/bugzilla/show_bug.cgi?id=13271

Rich Felker <bugdal at aerifal dot cx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|FIXED                       |WONTFIX

--- Comment #11 from Rich Felker <bugdal at aerifal dot cx> 2011-10-16 03:19:20 UTC ---
I'm tired of childish insults as a substitute for reading simple text. Changing
status to WONTFIX.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[jackie.rosen at hushmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=13271

Jackie Rosen <jackie.rosen at hushmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jackie.rosen at hushmail dot com

--- Comment #12 from Jackie Rosen <jackie.rosen at hushmail dot com> ---
*** Bug 260998 has been marked as a duplicate of this bug. ***
Seen from the domain http://volichat.com
Page where seen: http://volichat.com/adult-chat-rooms
Marked for reference. Resolved as fixed @bugzilla.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[schwab at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=13271

Andreas Schwab <schwab at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|jackie.rosen at hushmail dot com   |

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=13271

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe

[carlos at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=13271

Carlos O'Donell <carlos at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
                 CC|                            |carlos at redhat dot com
         Resolution|WONTFIX                     |---

--- Comment #13 from Carlos O'Donell <carlos at redhat dot com> ---
Reopening since this should be fixed.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe against concurrent setenv

[carlos at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=13271

Carlos O'Donell <carlos at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|getaddrinfo is not thread   |getaddrinfo is not thread
                   |safe                        |safe against concurrent
                   |                            |setenv

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/13271] getaddrinfo is not thread safe against concurrent setenv

[neleai at seznam dot cz]

https://sourceware.org/bugzilla/show_bug.cgi?id=13271

Ondrej Bilka <neleai at seznam dot cz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
                 CC|                            |neleai at seznam dot cz
         Resolution|---                         |DUPLICATE

--- Comment #14 from Ondrej Bilka <neleai at seznam dot cz> ---
It couldn't be fixed in general as Rich pointed out that user could setup
custom environment and deallocate it.

Anyway this is duplicate of generic request for threadsafe getenv. That should
be fixed in generic way.

*** This bug has been marked as a duplicate of bug 15607 ***

-- 
You are receiving this mail because:
You are on the CC list for the bug.