[Bug dynamic-link/17918] corrupt dtv causes segfault whith multithreaded dlopen/dlclose of shared objects with tls

[nszabolcs at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=17918

--- Comment #3 from Szabolcs Nagy <nszabolcs at gmail dot com> ---
the patch in

https://sourceware.org/ml/libc-alpha/2015-03/msg00563.html

gets rid of the dtv corruption, but i still see data races in the code and
failures on both x86_64 and aarch64:

Inconsistency detected by ld.so: dl-tls.c: 493: _dl_allocate_tls_init:
Assertion `listp->slotinfo[cnt].gen <= _rtld_local._dl_tls_generation' failed!

i think this happens because during pthread_create accesses
GL(dl_tls_max_dtv_idx) (== cnt at the assert failure) and GL(dl_tls_generation)
without holding the global rtld lock or using atomics.

both of those _rtld_local fileds are updated in dlopen and dlclose
independently while holding a lock (i think dlopen first updates the max dtv
idx when the module is mapped and if there is tls then the generation count is
updated too so there is a window where the idx is already new but gen is
outdated)

a simple fix is to just remove the assert (assuming the logic is otherwise
sound) and only access the max dtv idx with atomic load during pthread_create

(it's hard to reproduce it on x86_64, easier on aarch64)

-- 
You are receiving this mail because:
You are on the CC list for the bug.