[PATCH v3] elf: Release dl_load_lock before running dlopen constructors (BZ 15686)

[Florian Weimer]

* Artem Proskurnev:

> == Where it deadlocks
>
> Backtrace from the hung tokio blocking-pool worker that glycin spawns
> inside the dlopen constructor (captured via sudo gdb attach):
>
>   #0  futex_wait (futex_word=..., expected=2)
>           at ../sysdeps/nptl/futex-internal.h:126
>   #2  lll_mutex_lock_optimized (mutex=0x...<_rtld_local+1800>)
>           at pthread_mutex_lock.c:48
>   #4  _dl_open (file="libnss_systemd.so.2", mode=-2147483646,
>                caller_dlopen=<module_load+153>, ...)
>           at dl-open.c:819
>   #5  do_dlopen (...) at dl-libc.c:95
>   #9  __libc_dlopen_mode (...) at dl-libc.c:162
>   #10 module_load (...) at nss_module.c:187
>   #11 __nss_module_load (...) at nss_module.c:302
>   #13 __nss_lookup_function (..., fct_name="initgroups_dyn")
>           at nsswitch.c:125
>   #14 internal_getgrouplist (user="tema", group=500, ...)
>           at initgroups.c:95
>   #15 getgrouplist (...) at initgroups.c:156
>   #16 glycin::<...> () at /lib64/libglycin-2.so.0
>
> The mutex at _rtld_local+1800 is dl_load_lock.
>
> The triggering sequence is:
>
>   1. main thread: dlopen() grabs dl_load_lock
>   2. dl_open_worker -> call_dl_init -> libtest_init.so constructor
>   3. constructor -> gdk_pixbuf_new_from_file() -> glycin loader
>   4. glycin spawns a tokio blocking worker, which calls
>      getgrouplist("tema", ...) to compute supplementary groups for
>      the sandboxed subprocess credentials
>   5. getgrouplist -> __nss_lookup_function(initgroups_dyn) ->
>      __nss_module_load -> __libc_dlopen_mode("libnss_systemd.so.2")
>   6. _dl_open -> dl_load_lock acquisition -- already held by the
>      main thread inside the constructor -- deadlock

The bug is calling gdk_pixbuf_new_from_file from an ELF constructor?
Alternatively, the backends probably shouldn't spawn threads unless the
process is already multi-threaded.

Adhemerval's fix seems simple enough that we can merge it whether it
helps this particular scenario or not.

Thanks,
Florian