[Bug libc/27749] New: Data race __run_exit_handlers

[Bug libc/27749] New: Data race __run_exit_handlers

[vitalybuka at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27749

            Bug ID: 27749
           Summary: Data race __run_exit_handlers
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: vitalybuka at google dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

In our fleet it mostly manifested with tsan builds, which is very sensitive to
callback called twice. But I managed to reproduce with code like below of
regular builds.

With asserts it triggers internal accerts, without them it calls atexit
callback twice for the same argument.

It very similar to bug 14333, but the fix for that bug just significantly
reduced probability of the data race but not eliminated it completely.

I reproduced it on 2.27 and head, but I should be reproducible for earlier
versions as well.

#include <stdatomic.h>
#include <stdio.h>
#include <stdlib.h>
#include <support/xthread.h>
#include <sys/wait.h>
#include <unistd.h>

static atomic_int registered;
static atomic_int todo = 100000;

static void
atexit_cb (void *arg)
{
  --registered;
  static void *prev;
  if (arg == prev)
    {
      printf ("%p\n", arg);
      abort ();
    }
  prev = arg;

  while (todo > 0 && registered < 100)
    ;
}

int __cxa_atexit (void (*func) (void *), void *arg, void *d);

static void *cb_arg = NULL;
static void
add_handlers (void)
{
  int n = 10;
  for (int i = 0; i < n; ++i)
    __cxa_atexit (&atexit_cb, ++cb_arg, 0);
  registered += n;
  todo -= n;
}

static void *
thread_func (void *arg)
{
  while (todo > 0)
    if (registered < 10000)
      add_handlers ();
  return 0;
}

static void
test_and_exit (void)
{
  pthread_attr_t attr;

  xpthread_attr_init (&attr);
  xpthread_attr_setdetachstate (&attr, 1);

  xpthread_create (&attr, thread_func, NULL);
  xpthread_attr_destroy (&attr);
  while (!registered)
    ;
  exit (0);
}

static int
do_test (void)
{
  for (int i = 0; i < 20; ++i)
    {
      for (int i = 0; i < 10; ++i)
        if (fork () == 0)
          test_and_exit ();

      int status;
      while (wait (&status) > 0)
        {
          if (!WIFEXITED (status))
            {
              printf ("Failed interation %d\n", i);
              abort ();
            }
        }
    }

  exit (0);
}

#define TEST_FUNCTION do_test
#include <support/test-driver.c>

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/27749] Data race __run_exit_handlers

[vitalybuka at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27749

--- Comment #1 from Vitaly Buka <vitalybuka at google dot com> ---
The fix with the test
https://sourceware.org/pipermail/libc-alpha/2021-April/125170.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/27749] Data race __run_exit_handlers

[vitalybuka at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27749

--- Comment #2 from Vitaly Buka <vitalybuka at google dot com> ---
Fixed atomic usage in the test
https://sourceware.org/pipermail/libc-alpha/2021-April/125172.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/27749] Data race __run_exit_handlers

[adhemerval.zanella at linaro dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27749

Adhemerval Zanella <adhemerval.zanella at linaro dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
           Assignee|unassigned at sourceware dot org   |adhemerval.zanella at linaro dot o
                   |                            |rg
   Target Milestone|---                         |2.34
                 CC|                            |adhemerval.zanella at linaro dot o
                   |                            |rg
         Resolution|---                         |FIXED

--- Comment #3 from Adhemerval Zanella <adhemerval.zanella at linaro dot org> ---
Fixed on 2.34.

-- 
You are receiving this mail because:
You are on the CC list for the bug.