[RFC] Race in _dl_open with r_debug.r_state consistency

[suzuki]

hi,

One of our application was getting terminated with the following error

  "Inconsistency detected by ld.so: dl-open.c: 610: _dl_open: Assertion 
`_dl_debug_initialize (0, args.nsid)->r_state == RT_CONSISTENT' failed!

with glibc-2.4.31. This race seems to be present in the libc I got from 
the CVS [at code inspection]. We were able to reproduce this 
consistently after running for 4-5hrs.

Upon debugging we found that it is due to a race between two threads 
doing a _dl_open().

The scenario is something like this :

In elf/dl-open.c, _dl_open:


   /* Make sure we are alone.  */
   __rtld_lock_lock_recursive (GL(dl_load_lock));

[...]

   int errcode = _dl_catch_error (&objname, &errstring, &malloced,
                                  dl_open_worker, &args);
#ifndef MAP_COPY
   /* We must munmap() the cache file.  */
   _dl_unload_cache ();
#endif

   /* Release the lock.  */
   __rtld_lock_unlock_recursive (GL(dl_load_lock));

^^^^^ This would kick any other thread waiting on the lock.


if (__builtin_expect (errstring != NULL, 0))
   {
      [...]
    assert (_dl_debug_initialize (0, args.nsid)->r_state == RT_CONSISTENT);
   }

assert (_dl_debug_initialize (0, args.nsid)->r_state == RT_CONSISTENT);

And, if the thread which gets woken up is playing with the same 
namespace, and sets the r_state to RT_ADD in _dl_map_object_from_fd even 
before we reach here (truly possible in an SMP system),  ( due to 
getting scheduled out ), we would hit the assert !

So, it is not safe to believe that the r_state won't get changed once we 
release the lock.

One of the ways in which this can be fixed is releasing the lock only 
after we have done the consistency check. Attached patch does the same. 
This has been tested and does resolve the issue.

Could you please share your thoughts about the issue ? Is there a better 
way to fix this ?


Thanks,

-Suzuki
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: dl-open-race-fix.diff
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20061027/40a7946d/attachment.ksh>