[Bug dynamic-link/31285] New: Segfault when returning from main while a thread calls dlclose

[Bug dynamic-link/31285] New: Segfault when returning from main while a thread calls dlclose

[jimb@red-bean.com]

https://sourceware.org/bugzilla/show_bug.cgi?id=31285

            Bug ID: 31285
           Summary: Segfault when returning from main while a thread calls
                    dlclose
           Product: glibc
           Version: 2.38
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: jimb@red-bean.com
  Target Milestone: ---

If the program's main thread returns while another thread calls dlclose on a
shared library that has a static variable with a destructor, dlclose may unmap
the shared library's code while the main thread is still executing the
destructor, causing a crash.

This can manifest as intermittent crashes at exit, as in this issue:
https://github.com/gfx-rs/wgpu/issues/5084

The bug is that if the main thread calls `__run_exit_handlers` and finds the
shared library's destructor's entry in __exit_funcs` first, changes its flavor
to `ef_free`, releases `__exit_funcs_lock`, and then calls the entry's
function, that function is arbitrary code which may take a long time to run.
While it does so, another thread may `dlclose` the shared library, skip past
the entry in `__exit_funcs` since it is marked as `ef_free`, and proceed to
unmap the shared library's code while the main thread is still working.

The attached test case reproduces the bug reliably. To reproduce, download the
attached test case as `dlclose-crash.tar.gz`, and then:

```
$ tar xf dlclose-crash.tar.gz 
$ cd dlclose-crash/
$ make
g++ -g -export-dynamic main.cpp -o main
g++ -g  -shared -fPIC solib.cpp -o solib.so
$ ./main
Segmentation fault (core dumped)
$ 
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/31285] Segfault when returning from main while a thread calls dlclose

[jimb@red-bean.com]

https://sourceware.org/bugzilla/show_bug.cgi?id=31285

--- Comment #1 from Jim Blandy <jimb@red-bean.com> ---
Created attachment 15327
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15327&action=edit
Test case source code.

-- 
You are receiving this mail because:
You are on the CC list for the bug.