[Bug libc/23296] New: Data race in setting function descriptor during lazy binding
danglin at gcc dot gnu.org
sourceware-bugzilla@sourceware.org
Sat Jun 16 22:47:00 GMT 2018
https://sourceware.org/bugzilla/show_bug.cgi?id=23296
Bug ID: 23296
Summary: Data race in setting function descriptor during lazy
binding
Product: glibc
Version: unspecified
Status: NEW
Severity: normal
Priority: P2
Component: libc
Assignee: unassigned at sourceware dot org
Reporter: danglin at gcc dot gnu.org
CC: carlos at redhat dot com, deller at gmx dot de,
drepper.fsp at gmail dot com
Target Milestone: ---
Host: hppa-unknown-linux-gnu
Target: hppa-unknown-linux-gnu
Build: hppa-unknown-linux-gnu
The debian normaliz package defaults to using OpenMP. With OpenMP, the
testsuite
fails quite consistently on hppa-linux. If I disable OpenMP or export
LD_BIND_NOW=y, the testsuite doesn't fail. OpenMP is also disabled on
alpha-linux-gnu mipsel-linux-gnu. The comment indicates that random bus
errors occur on mipsel but I don't know that the problem is the same as hppa.
The most common failure on hppa is a SEGV in _dl_fixup. It appears the
reloc offset passed to _dl_fixup is corrupt. Presumably, this is caused
by a race in installing the function descriptor.
dave@mx3210:~/debian/normaliz/normaliz-3.6.0+ds$ gdb -c
./_build/test/run_tests/core
/home/dave/debian/normaliz/normaliz-3.6.0+ds/_build/source/.libs/normaliz
GNU gdb (Debian 7.12-6+b2) 7.12.0.20161007-git
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "hppa-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from
/home/dave/debian/normaliz/normaliz-3.6.0+ds/_build/source/.libs/normaliz...done.
[New LWP 14189]
[New LWP 14197]
[New LWP 14192]
[New LWP 14150]
[New LWP 14208]
[New LWP 14204]
[New LWP 14200]
[New LWP 14194]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/hppa-linux-gnu/libthread_db.so.1".
Core was generated by
`/home/dave/debian/normaliz/normaliz-3.6.0+ds/_build/source/.libs/normaliz -s
te'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 _dl_fixup (l=0xf8bdeb50, reloc_arg=4136748372) at dl-runtime.c:75
75 dl-runtime.c: No such file or directory.
[Current thread is 1 (Thread 0xf5c910c0 (LWP 14189))]
(gdb) bt
#0 _dl_fixup (l=0xf8bdeb50, reloc_arg=4136748372) at dl-runtime.c:75
#1 0xf8bcc730 in _dl_runtime_resolve () at ../sysdeps/hppa/dl-trampoline.S:83
#2 0xf87af7e4 in libnormaliz::Full_Cone<long long>::find_new_facets(unsigned
int const&) [clone ._omp_fn.13] () at
../../source/libnormaliz/full_cone.cpp:421
#3 0x00000000 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) disass
Dump of assembler code for function _dl_fixup:
0xf8bc564c <+0>: stw rp,-14(sp)
0xf8bc5650 <+4>: ldo 80(sp),sp
0xf8bc5654 <+8>: stw r7,-6c(sp)
0xf8bc5658 <+12>: ldo -70(sp),r7
0xf8bc565c <+16>: stw r6,-68(sp)
0xf8bc5660 <+20>: stw r5,-64(sp)
0xf8bc5664 <+24>: stw r4,-60(sp)
0xf8bc5668 <+28>: stw r3,-5c(sp)
0xf8bc566c <+32>: stw r19,-20(sp)
0xf8bc5670 <+36>: ldw 7c(r26),r21
0xf8bc5674 <+40>: ldw 4(r21),r22
0xf8bc5678 <+44>: ldw 38(r26),r20
0xf8bc567c <+48>: add,l r25,r22,r6
=> 0xf8bc5680 <+52>: ldw r25(r22),r3
0xf8bc5684 <+56>: ldw 4(r6),r21
0xf8bc5688 <+60>: extrw,u r21,23,24,r31
0xf8bc568c <+64>: depw,z r31,27,28,ret1
0xf8bc5690 <+68>: ldw 34(r26),r22
0xf8bc5694 <+72>: ldw 4(r20),r20
0xf8bc5698 <+76>: add,l ret1,r20,r20
0xf8bc569c <+80>: extrw,u r21,31,8,r21
0xf8bc56a0 <+84>: stw r20,0(r7)
---Type <return> to continue, or q <return> to quit---q
Quit
(gdb) list dl-runtime.c:75
70 in dl-runtime.c
(gdb) directory /home/dave/debian/glibc/glibc-2.27/elf
Source directories searched: /home/dave/debian/glibc/glibc-2.27/elf:$cdir:$cwd
(gdb) list dl-runtime.c:75
70
71 const PLTREL *const reloc
72 = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset);
73 const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)];
74 const ElfW(Sym) *refsym = sym;
75 void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);
76 lookup_t result;
77 DL_FIXUP_VALUE_TYPE value;
78
79 /* Sanity check that we're really looking at a PLT relocation. */
(gdb) info threads
Id Target Id Frame
* 1 Thread 0xf5c910c0 (LWP 14189) _dl_fixup (l=0xf8bdeb50,
reloc_arg=4136748372) at dl-runtime.c:75
2 Thread 0xf448e0c0 (LWP 14197) new_heap (size=0, top_pad=<optimized out>)
at arena.c:520
3 Thread 0xf54900c0 (LWP 14192) _dl_runtime_resolve ()
at ../sysdeps/hppa/dl-trampoline.S:50
4 Thread 0xf8cfb040 (LWP 14150) boost::operator&<unsigned long,
std::allocator<unsigned long> > (x=..., y=...)
at /usr/include/boost/dynamic_bitset/dynamic_bitset.hpp:1772
5 Thread 0xf2c8b0c0 (LWP 14208) new_heap (size=0, top_pad=<optimized out>)
at arena.c:520
6 Thread 0xf348c0c0 (LWP 14204) new_heap (size=0, top_pad=<optimized out>)
at arena.c:520
7 Thread 0xf3c8d0c0 (LWP 14200) new_heap (size=0, top_pad=<optimized out>)
at arena.c:520
8 Thread 0xf4c8f0c0 (LWP 14194) new_heap (size=0, top_pad=<optimized out>)
at arena.c:520
(gdb) thread 3
[Switching to thread 3 (Thread 0xf54900c0 (LWP 14192))]
#0 _dl_runtime_resolve () at ../sysdeps/hppa/dl-trampoline.S:50
50 stw %rp, -20(%sp)
(gdb) thread 2
[Switching to thread 2 (Thread 0xf448e0c0 (LWP 14197))]
#0 new_heap (size=0, top_pad=<optimized out>) at arena.c:520
520 arena.c: No such file or directory.
(gdb) thread 3
[Switching to thread 3 (Thread 0xf54900c0 (LWP 14192))]
#0 _dl_runtime_resolve () at ../sysdeps/hppa/dl-trampoline.S:50
50 stw %rp, -20(%sp)
(gdb) p/x $sp
$1 = 0xf4c904c0
(gdb) thread 1
[Switching to thread 1 (Thread 0xf5c910c0 (LWP 14189))]
#0 _dl_fixup (l=0xf8bdeb50, reloc_arg=4136748372) at dl-runtime.c:75
75 void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);
(gdb) p/x $sp
$2 = 0xf5491500
(gdb) p *l
$3 = {l_addr = 4166217728,
l_name = 0xf8bdeaf8
"/home/dave/debian/normaliz/normaliz-3.6.0+ds/_build/source/.libs/libnormaliz.so.3",
l_ld = 0xf8855a7c, l_next = 0xf8cff000,
l_prev = 0xf8bde668, l_real = 0xf8bdeb50, l_ns = 0, l_libname = 0xf8bdedac,
l_info = {0x0, 0xf8855ac4, 0xf8855b2c, 0xf8855b24, 0xf8855af4, 0xf8855b04,
0xf8855b0c, 0xf8855b44, 0xf8855b4c, 0xf8855b54, 0xf8855b14, 0xf8855b1c,
0xf8855ad4, 0xf8855adc, 0xf8855acc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf8855b34,
0x0, 0x0, 0xf8855b3c, 0x0, 0xf8855ae4, 0x0, 0xf8855aec, 0x0, 0x0, 0x0,
0x0, 0x0, 0x0, 0xf8855b64, 0xf8855b5c, 0x0, 0x0, 0x0, 0x0, 0xf8855b74,
0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf8855b6c,
0x0 <repeats 25 times>, 0xf8855afc}, l_phdr = 0xf8537034,
l_entry = 4166670160, l_phnum = 5, l_ldnum = 37, l_searchlist = {
r_list = 0x0, r_nlist = 0}, l_symbolic_searchlist = {r_list = 0xf8bdeda8,
r_nlist = 0}, l_loader = 0xf8bde668, l_versions = 0xf8cfd788,
l_nversions = 23, l_nbuckets = 2053, l_gnu_bitmask_idxbits = 1023,
l_gnu_shift = 15, l_gnu_bitmask = 0xf853cacc, {l_gnu_buckets = 0xf853dacc,
l_chain = 0xf853dacc}, {l_gnu_chain_zero = 0xf853f75c,
l_buckets = 0xf853f75c}, l_direct_opencount = 0, l_type = lt_library,
l_relocated = 1, l_init_called = 1, l_global = 1, l_reserved = 0,
l_phdr_allocated = 0, l_soname_added = 0, l_faked = 0, l_need_tls_init = 0,
l_auditing = 0, l_audit_any_plt = 0, l_removed = 0, l_contiguous = 1,
l_symbolic_in_local_scope = 0, l_free_initfini = 0, l_rpath_dirs = {
dirs = 0x0, malloced = 0}, l_reloc_result = 0x0, l_versyms = 0xf8593dd0,
---Type <return> to continue, or q <return> to quit---
l_origin = 0xf8bdedd0
"/home/dave/debian/normaliz/normaliz-3.6.0+ds/_build/source/.libs", l_map_start
= 4166217728, l_map_end = 4169519492,
l_text_end = 4169523200, l_scope_mem = {0xf8bde7c4, 0x0, 0x0, 0x0},
l_scope_max = 4, l_scope = 0xf8bded08, l_local_scope = {0xf8bdecac, 0x0},
l_file_id = {dev = 2065, ino = 4994321}, l_runpath_dirs = {dirs = 0x0,
malloced = 0}, l_initfini = 0xf8d00b88, l_reldeps = 0x0, l_reldepsmax = 0,
l_used = 1, l_feature_1 = 0, l_flags_1 = 0, l_flags = 0, l_idx = 0,
l_mach = {fptr_table_len = 3690, fptr_table = 0xf8ce0000}, l_lookup_cache = {
sym = 0xf8543ed4, type_class = 0, value = 0xf8cffde8, ret = 0xf6fd5fe8},
l_tls_initimage = 0x0, l_tls_initimage_size = 0, l_tls_blocksize = 0,
l_tls_align = 0, l_tls_firstbyte_offset = 0, l_tls_offset = 0,
l_tls_modid = 0, l_tls_dtor_count = 0, l_relro_addr = 0, l_relro_size = 0,
l_serial = 2, l_audit = 0xf8bdeda8}
(gdb) p *reloc
value has been optimized out
(gdb) ptype reloc
type = const struct {
Elf32_Addr r_offset;
Elf32_Word r_info;
Elf32_Sword r_addend;
} * const
(gdb) x/3x $r25
0xf691c554: 0x00031ee8 0xf8d00368 0xf691bed8
(gdb) frame 2
#2 0xf87af7e4 in libnormaliz::Full_Cone<long long>::find_new_facets(unsigned
int const&) [clone ._omp_fn.13] () at
../../source/libnormaliz/full_cone.cpp:421
421 for (; jj!= Neg_Subfacet_Multi_United.end(); ++jj) {
(gdb) disass $pc-16,$pc+16
Dump of assembler code from 0xf87af7d4 to 0xf87af7f4:
0xf87af7d4
<_ZN11libnormaliz9Full_ConeIxE15find_new_facetsERKj._omp_fn.13+752>: ldw
14(r26),r20
0xf87af7d8
<_ZN11libnormaliz9Full_ConeIxE15find_new_facetsERKj._omp_fn.13+756>: stw
r20,54(r22)
0xf87af7dc
<_ZN11libnormaliz9Full_ConeIxE15find_new_facetsERKj._omp_fn.13+760>: b,l
0xf87b7098,rp
0xf87af7e0
<_ZN11libnormaliz9Full_ConeIxE15find_new_facetsERKj._omp_fn.13+764>: copy
r19,r4
=> 0xf87af7e4
<_ZN11libnormaliz9Full_ConeIxE15find_new_facetsERKj._omp_fn.13+768>: copy
r4,r19
0xf87af7e8
<_ZN11libnormaliz9Full_ConeIxE15find_new_facetsERKj._omp_fn.13+772>: b,l
0xf87b9630,rp
0xf87af7ec
<_ZN11libnormaliz9Full_ConeIxE15find_new_facetsERKj._omp_fn.13+776>: copy
r19,r4
0xf87af7f0
<_ZN11libnormaliz9Full_ConeIxE15find_new_facetsERKj._omp_fn.13+780>:
cmpib,= 0,ret0,0xf87af818
<_ZN11libnormaliz9Full_ConeIxE15find_new_facetsERKj._omp_fn.13+820>
End of assembler dump.
(gdb) p/x $r19
$4 = 0xf8bdd164
(gdb) frame 0
#0 _dl_fixup (l=0xf8bdeb50, reloc_arg=4136748372) at dl-runtime.c:75
75 void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);
(gdb) p/x $r25
$5 = 0xf691c554
(gdb) x/4i 0xf87b9630
0xf87b9630: addil L%-1800,r19,r1
0xf87b9634: ldw a8(r1),r21
0xf87b9638: bv r0(r21)
0xf87b963c: ldw ac(r1),r19
--
You are receiving this mail because:
You are on the CC list for the bug.
More information about the Glibc-bugs
mailing list