From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <sourceware-bugzilla@sourceware.org>
Received: by sourceware.org (Postfix, from userid 48)
 id DC96B3861865; Sat, 20 Feb 2021 22:33:52 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org DC96B3861865
From: "aa1ronham at gmail dot com" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sourceware.org
Subject: [Bug nptl/21032] pthread_key_create() destructors and segfault after
 a DSO unloading
Date: Sat, 20 Feb 2021 22:33:52 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: glibc
X-Bugzilla-Component: nptl
X-Bugzilla-Version: 2.24
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: aa1ronham at gmail dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: security-
X-Bugzilla-Changed-Fields: cc attachments.created
Message-ID: <bug-21032-131-QWszWNcwni@http.sourceware.org/bugzilla/>
In-Reply-To: <bug-21032-131@http.sourceware.org/bugzilla/>
References: <bug-21032-131@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: glibc-bugs@sourceware.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Glibc-bugs mailing list <glibc-bugs.sourceware.org>
List-Unsubscribe: <https://sourceware.org/mailman/options/glibc-bugs>,
 <mailto:glibc-bugs-request@sourceware.org?subject=unsubscribe>
List-Archive: <https://sourceware.org/pipermail/glibc-bugs/>
List-Help: <mailto:glibc-bugs-request@sourceware.org?subject=help>
List-Subscribe: <https://sourceware.org/mailman/listinfo/glibc-bugs>,
 <mailto:glibc-bugs-request@sourceware.org?subject=subscribe>
X-List-Received-Date: Sat, 20 Feb 2021 22:33:53 -0000

https://sourceware.org/bugzilla/show_bug.cgi?id=3D21032

aa1ronham at gmail dot com <aa1ronham at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aa1ronham at gmail dot com

--- Comment #2 from aa1ronham at gmail dot com <aa1ronham at gmail dot com>=
 ---
Created attachment 13236
  --> https://sourceware.org/bugzilla/attachment.cgi?id=3D13236&action=3Ded=
it
Minimal reproduction

I've attached a minimal reproduction of the issue (GitHub repository:
https://github.com/Aaron1011/pthread_dlopen)

It does the following:
1. Spawn a new thread from `main()`, and block on it using `pthread_join`
2. From the new thread, load a simple shared library, and call a function in
it.
3. In the shared library, call `pthread_key_create` with a destrutor functi=
on,
and call `pthread_setspecific` with a non-NULL value to force the destrutor=
 to
actually run on thread exit.
4. Back in the main program (on the thread), call `dlclose` on the shared
library.
5. Return from the thread function

This causes the following segfault:

```
[Current thread is 1 (Thread 0x7facc3ff4640 (LWP 701108))]
gef=E2=9E=A4  bt
#0  0x00007facc4229129 in ?? ()
#1  0x00007facc41cd411 in __nptl_deallocate_tsd.part.0 () from
/usr/lib/libpthread.so.0
#2  0x00007facc41ce2ba in start_thread () from /usr/lib/libpthread.so.0
#3  0x00007facc40f7053 in clone () from /usr/lib/libc.so.6
gef=E2=9E=A4  q
```

--=20
You are receiving this mail because:
You are on the CC list for the bug.=