[Bug nptl/25847] pthread_cond_signal failed to wake up pthread_cond_wait due to a bug in undoing stealing

["carlos at redhat dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=25847

--- Comment #46 from Carlos O'Donell <carlos at redhat dot com> ---
(In reply to Malte Skarupke from comment #45)
> I looked into this bug again because people kept on running into it. I ran a
> bigger TLA+ analysis and found an interleaving where the mitigation patch
> doesn't help. I wrote it up on my blog again here:
> 
> https://probablydance.com/2022/09/17/finding-the-second-bug-in-glibcs-
> condition-variable/

I'll have a look at this when I'm back from GNU Tools Cauldron. It's
disappointing that there is still an interleaving that doesn't work. I've had a
community member testing Frank Barrus' patch and that did seem to be correct.

> The short of it is that the pthread_cond_broadcast() in the mitigation patch
> can early-out when no thread is sleeping at the same time, in which case it
> doesn't wake anyone and doesn't change any state. Meaning the mitigation
> patch might do nothing. But the leftover signal from the wait will stick
> around. After that you can get a similar interleaving as before which will
> result in an incorrect g_size, causing pthread_cond_signal() to wake in the
> wrong group.
> 
> It's less likely than before, because you need three rare things to happen,
> but it can still happen:
> 1. Trigger the potential steal
> 2. The pthread_cond_broadcast() from the mitigation patch has to early-out
> without doing anything
> 3. You need to consume that extra signal from the potential steal at a time
> where it will cause quiesce_and_switch_g1() to increase g_size to at least 2
> 
> My patch from a year ago should fix this:
> https://sourceware.org/pipermail/libc-alpha/2021-September/130840.html

Could you expand on this a bit? Do you mean to say your patch from last
September resolves all the issues you have seen, including the new one?

-- 
You are receiving this mail because:
You are on the CC list for the bug.