[Bug libc/14333] New: Fix the race between atexit() and exit()

[Bug libc/14333] New: Fix the race between atexit() and exit()

[penght at cn dot fujitsu.com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14333

             Bug #: 14333
           Summary: Fix the race between atexit() and exit()
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: unassigned@sourceware.org
        ReportedBy: penght@cn.fujitsu.com
                CC: carlos@systemhalted.org, drepper.fsp@gmail.com
    Classification: Unclassified


Created attachment 6511
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6511
The Patch can fix the race betweent atexit() and exit()

exit() uses global variable __exit_funcs indirectly, which are not protected.
It is not safe in multithread circumstance.

When call exit() and atexit() simultaneously in multithread circumstance,
the following case will cause unsafe.
The case has main process A and thread B.

a. thread B call atexit()
b. process A call exit() to traverse the __exit_funcs list
c. thread B call calloc() to create a new entry p, and next to listp:
   p->next = *listp;
d. process A modify listp to cur's next, then free cur:
   *listp = cur->next;
e. thread B modify listp to p:
   *listp = p;
f. when get f, the f is undefined:
   const struct exit_function *const f =
     &cur->fns[--cur->idx];
g. programme may be Segmentation fault

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14333] Fix the race between atexit() and exit()

[carlos_odonell at mentor dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14333

Carlos O'Donell <carlos_odonell at mentor dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |carlos_odonell at mentor
                   |                            |dot com

--- Comment #1 from Carlos O'Donell <carlos_odonell at mentor dot com> 2012-10-11 14:16:56 UTC ---
We're seeing failures on hppa in this area while running some of gcc's
testsuite and it looks like a similar issue. John David Anglin is investigating
for me on the gcc side.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14333] Fix the race between atexit() and exit()

[penght at cn dot fujitsu.com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14333

Peng Haitao <penght at cn dot fujitsu.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #6511|1                           |0
           is patch|                            |
   Attachment #6511|0                           |1
        is obsolete|                            |

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14333] Fix the race between atexit() and exit()

[penght at cn dot fujitsu.com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14333

--- Comment #2 from Peng Haitao <penght at cn dot fujitsu.com> 2012-10-12 02:41:37 UTC ---
Created attachment 6682
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6682
The Patch can fix the race betweent atexit() and exit()

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14333] Fix the race between atexit() and exit()

[siddhesh at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14333

Siddhesh Poyarekar <siddhesh at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |siddhesh at redhat dot com

--- Comment #3 from Siddhesh Poyarekar <siddhesh at redhat dot com> 2012-10-18 03:09:57 UTC ---
Please post the patch on libc-alpha.  If you've posted before and not got a
response, then please repost it.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14333] Fix the race between atexit() and exit()

[penght at cn dot fujitsu.com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14333

--- Comment #4 from Peng Haitao <penght at cn dot fujitsu.com> 2012-10-22 07:52:53 UTC ---
(In reply to comment #3)
> Please post the patch on libc-alpha.  If you've posted before and not got a
> response, then please repost it.

I have reposted the patch to libc-alpha, please review.
URL: http://sourceware.org/ml/libc-alpha/2012-10/msg00567.html

Thanks.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14333] Fix the race between atexit() and exit()

[carlos at systemhalted dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14333

Carlos O'Donell <carlos at systemhalted dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|carlos_odonell at mentor    |
                   |dot com                     |

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14333] Fix the race between atexit() and exit()

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14333

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/14333] Fix the race between atexit() and exit()

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14333

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.