[RFC]setlocale() race condition

[Sharyathi Nagesh]

Hi

	This problem was noticed with glibc shipped with distro, older version 
of glibc 2.5-12, the problem is noticed after 8 hours of testing and 
application crashed with SIGSEGV. My efforts to replicate the problem 
with main line glibc was not successful, but I still feel the problem is 
there even with main line glibc and wished to know your thoughts on this 
issue
-----------------------------------------------------------------
Explanation:
	This problem was noticed during PHP engine development, current 
implementation calls setlocale() every time a page is requested. The 
problem is noticed during stress test of this enging
	setlocale() is being called on multiple threads. The exact api calls 
are as follows
....
setlocale(LC_ALL,'C');
....
setlocale(LC_TYPE,'');
....
setlocale(LC_CTYPE,'C');
....
	It was observed that after ~8 hours of testing, application crashed at 
strcmp() call made from setlocale(), when I analyzed the dump it showed 
that _nl_global_locale.__names[category] pointer was corrupted.
	When I went through the code, I see a window of race condition where 
one thread will call strcmp()(with in setlocale()) with current value of 
_nl_global_locale.__names[category] passed as argument, while another 
thread goes ahead and frees the string pointer pointed by 
_nl_global_locale.__names[category].

	Since the man page of setlocale() doesn't talk any thing about the call 
`not being re-entrant` I assume  setlocale() to be re-entrant
-----------------------------------------------------------------
Testing:
  	Didn't notice any regression with testing. Testing was done under 
x86-64 box where the application was built as 32bit.
-----------------------------------------------------------------	
Fix:
	Similar fix, fixed the problem with distro glibc, where 
__libc_lock_lock() is used instead of __libc_rwlock_rdlock()


Thanks
Yeehaw

-------------- next part --------------
A non-text attachment was scrubbed...
Name: setlocale_race.patch
Type: text/x-patch
Size: 877 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-help/attachments/20080612/891cf1d6/attachment.bin>