[Bug libc/18429] New: spurious timer wakeup caused by ABA problem in timers handling logic

[Bug libc/18429] New: spurious timer wakeup caused by ABA problem in timers handling logic

[up7 at frtk dot ru]

https://sourceware.org/bugzilla/show_bug.cgi?id=18429

            Bug ID: 18429
           Summary: spurious timer wakeup caused by ABA problem in timers
                    handling logic
           Product: glibc
           Version: 2.21
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: up7 at frtk dot ru
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Suppose a timer uses signal delivery to the helper thread.  The following
sequence of events happens:

1. Timer A created, suppose it's address is a_ptr. It is added to
__active_timer_sigev_thread list:

      /* Add to the queue of active timers with thread
         delivery.  */
      pthread_mutex_lock (&__active_timer_sigev_thread_lock);
      newp->next = __active_timer_sigev_thread;
      __active_timer_sigev_thread = newp;
      pthread_mutex_unlock (&__active_timer_sigev_thread_lock);

2. timer_helper_thread receives A signal. rt_sigtimedwait returns success:

      /* XXX The size argument hopefully will have to be changed to the
         real size of the user-level sigset_t.  */
      int result = INLINE_SYSCALL (rt_sigtimedwait, 4, &ss, &si, NULL,
                                   _NSIG / 8);

But right after that timer_helper_thread is preemted.

3. High prio thread deletes timer A. It's address is deleted from
__active_timer_sigev_thread list. And then creates timer B. Suppose it's
address is also a_ptr. This address is again inserted in
__active_timer_sigev_thread list.

4. timer_helper_thread continue execution. It checks presence of a_ptr in
_active_timer_sigev_thread list and executes it.

              struct timer *tk = (struct timer *) si.si_ptr;

              /* Check the timer is still used and will not go away
                 while we are reading the values here.  */
              pthread_mutex_lock (&__active_timer_sigev_thread_lock);

              struct timer *runp = __active_timer_sigev_thread;
              while (runp != NULL)
                if (runp == tk)
                  break;
                else
                  runp = runp->next;

              if (runp != NULL)
                {
                  struct thread_start_data *td = malloc (sizeof (*td));

                  /* There is not much we can do if the allocation fails.  */
                  if (td != NULL)
                    {
                      /* This is the signal we are waiting for.  */
                      td->thrfunc = tk->thrfunc;
                      td->sival = tk->sival;

                      pthread_t th;
                      (void) pthread_create (&th, &tk->attr,
                                             timer_sigev_thread, td);
                    }
                }

              pthread_mutex_unlock (&__active_timer_sigev_thread_lock);

So in this case timer B receives spurious wake up.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18429] spurious timer wakeup caused by ABA problem in timers handling logic

[up7 at frtk dot ru]

https://sourceware.org/bugzilla/show_bug.cgi?id=18429

Dmitry Mikhin <up7 at frtk dot ru> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |up7 at frtk dot ru

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug librt/18429] spurious timer wakeup caused by ABA problem in timers handling logic

[jsm28 at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=18429

Joseph Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|libc                        |librt

-- 
You are receiving this mail because:
You are on the CC list for the bug.