From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <sourceware-bugzilla@sourceware.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 43B76388A02F; Sat, 17 Apr 2021 16:15:16 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 43B76388A02F
From: "vitalybuka at google dot com" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sourceware.org
Subject: [Bug libc/27749] New: Data race __run_exit_handlers
Date: Sat, 17 Apr 2021 16:15:15 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: glibc
X-Bugzilla-Component: libc
X-Bugzilla-Version: unspecified
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: vitalybuka at google dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter cc target_milestone
Message-ID: <bug-27749-131@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: glibc-bugs@sourceware.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Glibc-bugs mailing list <glibc-bugs.sourceware.org>
List-Unsubscribe: <https://sourceware.org/mailman/options/glibc-bugs>,
 <mailto:glibc-bugs-request@sourceware.org?subject=unsubscribe>
List-Archive: <https://sourceware.org/pipermail/glibc-bugs/>
List-Help: <mailto:glibc-bugs-request@sourceware.org?subject=help>
List-Subscribe: <https://sourceware.org/mailman/listinfo/glibc-bugs>,
 <mailto:glibc-bugs-request@sourceware.org?subject=subscribe>
X-List-Received-Date: Sat, 17 Apr 2021 16:15:16 -0000

https://sourceware.org/bugzilla/show_bug.cgi?id=3D27749

            Bug ID: 27749
           Summary: Data race __run_exit_handlers
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: vitalybuka at google dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

In our fleet it mostly manifested with tsan builds, which is very sensitive=
 to
callback called twice. But I managed to reproduce with code like below of
regular builds.

With asserts it triggers internal accerts, without them it calls atexit
callback twice for the same argument.

It very similar to bug 14333, but the fix for that bug just significantly
reduced probability of the data race but not eliminated it completely.

I reproduced it on 2.27 and head, but I should be reproducible for earlier
versions as well.

#include <stdatomic.h>
#include <stdio.h>
#include <stdlib.h>
#include <support/xthread.h>
#include <sys/wait.h>
#include <unistd.h>

static atomic_int registered;
static atomic_int todo =3D 100000;

static void
atexit_cb (void *arg)
{
  --registered;
  static void *prev;
  if (arg =3D=3D prev)
    {
      printf ("%p\n", arg);
      abort ();
    }
  prev =3D arg;

  while (todo > 0 && registered < 100)
    ;
}

int __cxa_atexit (void (*func) (void *), void *arg, void *d);

static void *cb_arg =3D NULL;
static void
add_handlers (void)
{
  int n =3D 10;
  for (int i =3D 0; i < n; ++i)
    __cxa_atexit (&atexit_cb, ++cb_arg, 0);
  registered +=3D n;
  todo -=3D n;
}

static void *
thread_func (void *arg)
{
  while (todo > 0)
    if (registered < 10000)
      add_handlers ();
  return 0;
}

static void
test_and_exit (void)
{
  pthread_attr_t attr;

  xpthread_attr_init (&attr);
  xpthread_attr_setdetachstate (&attr, 1);

  xpthread_create (&attr, thread_func, NULL);
  xpthread_attr_destroy (&attr);
  while (!registered)
    ;
  exit (0);
}

static int
do_test (void)
{
  for (int i =3D 0; i < 20; ++i)
    {
      for (int i =3D 0; i < 10; ++i)
        if (fork () =3D=3D 0)
          test_and_exit ();

      int status;
      while (wait (&status) > 0)
        {
          if (!WIFEXITED (status))
            {
              printf ("Failed interation %d\n", i);
              abort ();
            }
        }
    }

  exit (0);
}

#define TEST_FUNCTION do_test
#include <support/test-driver.c>

--=20
You are receiving this mail because:
You are on the CC list for the bug.=