[PATCH v6 1/1] nptl: Fix Race conditions in pthread cancellation [BZ#12683]

[Adhemerval Zanella Netto]

On 22/05/23 18:19, DJ Delorie wrote:
> 
> FYI I did a build on my F35 machine with the trybot's commands and
> replicated the large list of failures from the trybot.
> 
> dj@envy pts/23 ~/tools/upstream/glibc.cancel.build
> $ ./debugglibc.sh rt/tst-timer2
> 
> Debugging glibc...
> Build directory  : /envy/dj/tools/upstream/glibc.cancel.build/
> Source directory : /envy/dj/tools/upstream/glibc.cancel
> GLIBC Testcase   : rt/tst-timer2
> GDB Commands     : /envy/dj/tools/upstream/glibc.cancel.build/debugglibc.gdb
> Env vars         : LC_ALL=C LOCPATH=/envy/dj/tools/upstream/glibc.cancel.build//localedata GCONV_PATH=/envy/dj/tools/upstream/glibc.cancel.build//iconvdata 
> 
> Reading symbols from /envy/dj/tools/upstream/glibc.cancel.build//elf/ld.so...
> add symbol table from file "rt/tst-timer2"
> Breakpoint 1 at 0x1970e
> Debuginfod has been disabled.
> To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
> warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available.
> 
> Breakpoint 1, 0xf7fe470e in _dl_start_user () from /envy/dj/tools/upstream/glibc.cancel.build/elf/ld.so
> 
> [ gdb ] c
> Continuing.
> cnt = 0
> [New LWP 3163750]
> 
> Thread 1 "ld.so" received signal SIGSEGV, Segmentation fault.
> __syscall_cancel_arch () at ../sysdeps/unix/sysv/linux/i386/syscall_cancel.S:50
> 50		testb	$TCB_CANCELED_BITMASK, (%eax)
> 
> [ gdb ] where
> #0  __syscall_cancel_arch () at ../sysdeps/unix/sysv/linux/i386/syscall_cancel.S:50
> #1  0xf7e0101d in __internal_syscall_cancel (a1=1, a2=-13216, a3=8, a4=0, a5=0, a6=0, nr=4) at cancellation.c:49
> #2  0xf7e01070 in __syscall_cancel (a1=1, a2=-13216, a3=8, a4=0, a5=0, a6=0, nr=4) at cancellation.c:70
> #3  0xf7e84ffc in __GI___libc_write (fd=1, buf=0xffffcc60, nbytes=8) at ../sysdeps/unix/sysv/linux/write.c:26
> #4  0xf7dfcc3b in _IO_new_file_write (f=0xf7fb1da0 <_IO_2_1_stdout_>, data=0xffffcc60, n=8) at fileops.c:1180
> #5  0xf7dfaba3 in new_do_write (fp=fp@entry=0xf7fb1da0 <_IO_2_1_stdout_>, data=data@entry=0xffffcc60 "cnt = 1\n\300\342\377", <incomplete sequence \367>, to_do=to_do@entry=8)
>     at /envy/dj/tools/upstream/glibc.cancel/libio/libioP.h:1031
> #6  0xf7dfcde7 in _IO_new_file_xsputn (n=8, data=<optimized out>, f=0xf7fb1da0 <_IO_2_1_stdout_>) at fileops.c:1254
> #7  _IO_new_file_xsputn (f=0xf7fb1da0 <_IO_2_1_stdout_>, data=<optimized out>, n=8) at fileops.c:1196
> #8  0xf7dd37f6 in __printf_buffer_flush_to_file (buf=0xffffcc44) at ../libio/libioP.h:1031
> #9  0xf7dd38b8 in __printf_buffer_to_file_done (buf=0xffffcc44) at printf_buffer_to_file.c:120
> #10 0xf7ddceaf in __vfprintf_internal (s=0xf7fb1da0 <_IO_2_1_stdout_>, format=0xf7fc1010 "cnt = %d\n", ap=0xffffcd24 "\001", mode_flags=0) at vfprintf-internal.c:1475
> #11 0xf7dd2fb5 in __printf (format=0xf7fc1010 "cnt = %d\n") at printf.c:33
> #12 0xf7fbf65a in ?? ()
> Backtrace stopped: previous frame inner to this frame (corrupt stack?)
> 
> [ gdb ] info reg
> eax            0x1                 1
> ecx            0xf7d80780          -136837248
> edx            0x0                 0
> ebx            0xf7d80700          -136837376
> esp            0xffffca5c          0xffffca5c
> ebp            0xf7fb1da0          0xf7fb1da0 <_IO_2_1_stdout_>
> esi            0x8                 8
> edi            0xffffcc60          -13216
> eip            0xf7e0d4c4          0xf7e0d4c4 <__syscall_cancel_arch+4>
> eflags         0x10246             [ PF ZF IF RF ]
> cs             0x23                35
> ss             0x2b                43
> ds             0x2b                43
> es             0x2b                43
> fs             0x0                 0
> gs             0x63                99
> 
> [ gdb ] 
> 

Thanks, it seems that CFI information is wrong somewhere.  I will take a look
where it can be.