public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
From: "ppluzhnikov at google dot com" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sourceware.org
Subject: [Bug nptl/24776] pthread_key_create, pthread_setspecific are incompatible with dlmopen
Date: Sat, 20 Nov 2021 16:37:22 +0000	[thread overview]
Message-ID: <bug-24776-131-9DfRRvYHPR@http.sourceware.org/bugzilla/> (raw)
In-Reply-To: <bug-24776-131@http.sourceware.org/bugzilla/>

https://sourceware.org/bugzilla/show_bug.cgi?id=24776

Paul Pluzhnikov <ppluzhnikov at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ppluzhnikov at google dot com

--- Comment #13 from Paul Pluzhnikov <ppluzhnikov at google dot com> ---
There is a more fundamental problem with pthread_key_create from dlmopen'ed
copy of libpthread: it creates duplicate keys (since it looks in the local copy
of __pthread_keys).

The key is then used as an index into THREAD_SELF->specific_1stblock etc, which
is shared between all the namespaces, with a disastrous result.

Real-life example: https://stackoverflow.com/q/70030529

Trivial repro:

// --- cut ---
#define _GNU_SOURCE
#include <assert.h>
#include <dlfcn.h>
#include <pthread.h>

typedef int (*pthread_key_create_t)(pthread_key_t *, void (*)(void*));
int main()
{
  pthread_key_t k1, k2;
  int rc;

  rc = pthread_key_create(&k1, NULL);
  void *h = dlmopen(LM_ID_NEWLM, "libpthread.so.0", RTLD_LAZY);
  assert(h != NULL);

  pthread_key_create_t fn = (pthread_key_create_t)dlsym(h,
"pthread_key_create");
  assert(fn != NULL);

  rc = fn(&k2, NULL);
  assert(rc == 0);
  assert(k2 != k1);

  return 0;
}
// --- cut ---

gcc -g t.c -pthread -ldl -Wall -Wextra
./a.out
a.out: t.c:21: main: Assertion `k2 != k1' failed.
Aborted

-- 
You are receiving this mail because:
You are on the CC list for the bug.

  parent reply	other threads:[~2021-11-20 16:37 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <bug-24776-131@http.sourceware.org/bugzilla/>
2021-04-21 19:40 ` fweimer at redhat dot com
2021-05-31 18:10 ` fweimer at redhat dot com
2021-05-31 18:10 ` fweimer at redhat dot com
2021-08-08  5:15 ` alxchk at gmail dot com
2021-08-08 11:06 ` sware at reimardoeffinger dot de
2021-11-20 16:37 ` ppluzhnikov at google dot com [this message]
2022-10-01 17:16 ` jadahl at gmail dot com
2023-04-24 12:17 ` kristofer.berggren at gmail dot com

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=bug-24776-131-9DfRRvYHPR@http.sourceware.org/bugzilla/ \
    --to=sourceware-bugzilla@sourceware.org \
    --cc=glibc-bugs@sourceware.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).