From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <sourceware-bugzilla@sourceware.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 9F73D3858419; Sat, 20 Nov 2021 16:37:22 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 9F73D3858419
From: "ppluzhnikov at google dot com" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sourceware.org
Subject: [Bug nptl/24776] pthread_key_create, pthread_setspecific are
 incompatible with dlmopen
Date: Sat, 20 Nov 2021 16:37:22 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: glibc
X-Bugzilla-Component: nptl
X-Bugzilla-Version: 2.30
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: ppluzhnikov at google dot com
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: security-
X-Bugzilla-Changed-Fields: cc
Message-ID: <bug-24776-131-9DfRRvYHPR@http.sourceware.org/bugzilla/>
In-Reply-To: <bug-24776-131@http.sourceware.org/bugzilla/>
References: <bug-24776-131@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: glibc-bugs@sourceware.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Glibc-bugs mailing list <glibc-bugs.sourceware.org>
List-Unsubscribe: <https://sourceware.org/mailman/options/glibc-bugs>,
 <mailto:glibc-bugs-request@sourceware.org?subject=unsubscribe>
List-Archive: <https://sourceware.org/pipermail/glibc-bugs/>
List-Help: <mailto:glibc-bugs-request@sourceware.org?subject=help>
List-Subscribe: <https://sourceware.org/mailman/listinfo/glibc-bugs>,
 <mailto:glibc-bugs-request@sourceware.org?subject=subscribe>
X-List-Received-Date: Sat, 20 Nov 2021 16:37:22 -0000

https://sourceware.org/bugzilla/show_bug.cgi?id=3D24776

Paul Pluzhnikov <ppluzhnikov at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ppluzhnikov at google dot =
com

--- Comment #13 from Paul Pluzhnikov <ppluzhnikov at google dot com> ---
There is a more fundamental problem with pthread_key_create from dlmopen'ed
copy of libpthread: it creates duplicate keys (since it looks in the local =
copy
of __pthread_keys).

The key is then used as an index into THREAD_SELF->specific_1stblock etc, w=
hich
is shared between all the namespaces, with a disastrous result.

Real-life example: https://stackoverflow.com/q/70030529

Trivial repro:

// --- cut ---
#define _GNU_SOURCE
#include <assert.h>
#include <dlfcn.h>
#include <pthread.h>

typedef int (*pthread_key_create_t)(pthread_key_t *, void (*)(void*));
int main()
{
  pthread_key_t k1, k2;
  int rc;

  rc =3D pthread_key_create(&k1, NULL);
  void *h =3D dlmopen(LM_ID_NEWLM, "libpthread.so.0", RTLD_LAZY);
  assert(h !=3D NULL);

  pthread_key_create_t fn =3D (pthread_key_create_t)dlsym(h,
"pthread_key_create");
  assert(fn !=3D NULL);

  rc =3D fn(&k2, NULL);
  assert(rc =3D=3D 0);
  assert(k2 !=3D k1);

  return 0;
}
// --- cut ---

gcc -g t.c -pthread -ldl -Wall -Wextra
./a.out
a.out: t.c:21: main: Assertion `k2 !=3D k1' failed.
Aborted

--=20
You are receiving this mail because:
You are on the CC list for the bug.=