From patchwork Thu Jul 25 18:41:44 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adhemerval Zanella X-Patchwork-Id: 814370 Delivered-To: patch@linaro.org Received: by 2002:adf:e641:0:b0:367:895a:4699 with SMTP id b1csp527144wrn; Thu, 25 Jul 2024 11:44:17 -0700 (PDT) X-Forwarded-Encrypted: i=3; AJvYcCXFWNp1bkkRtMbbetbV+Wx5nFvxcNSXXSNk4mIRF3qNmeTyegvz7/Y8sIFiaAeAta6wqaQfX51sq873AK1Djk4Q X-Google-Smtp-Source: AGHT+IFCNGuBCXJj7OP4VJ+rkSp89KvcxdxfsCnYdcgN462VhSvo45aPgXY/wVgpVn6f3scbJlP/ X-Received: by 2002:a05:622a:44c:b0:44f:ea31:cdbd with SMTP id d75a77b69052e-44fea31e9bcmr48865971cf.24.1721933057451; Thu, 25 Jul 2024 11:44:17 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1721933057; cv=pass; d=google.com; s=arc-20160816; b=m0V6yvxi/obbGL5rjfGliHifuS7cWxBzFez0nXJygL0dXvHkAet9uXRXoKOz0ELZ4Z fXWv/bsZjBkvw7x+Z2MMddYS6PP7BhOh6toQf3Rg/hlIus+dbWA+EUsGJEg+mFycFh6H dZW636ktrC06Ipd6tNwN5bz7qi14N1D1r/RL+RLNwe1y+revg4mz4GJBNMggsxugq7OA C3X1v/81Fi1RNbxvyxVSwHNrHyRpfkkuFdzUnsLABvBNusEazqUf7c9paatHkRLnUGBm SEQ5SdVD/s8vOjZB02H5bahLIdHka/5zjMxQMoo0ak/v6LecGPr80eOeyx+Tgr0p8kB2 p/Hw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature :arc-filter:dmarc-filter:delivered-to; bh=RiQR1VnwchEEdjoqyJT9Jgl9B4NI8Rr04drzFTo4IQA=; fh=l7QVefBQu5/74FtisLxxsaXwavctI7mllEZpcPZXgCs=; b=K7MfqN4N6ScMQ79/JbbXv1DulfExq7+9V1tL/QWH7EeArSNY7uzPP6tB6U1NqtYp9C 8IoY+VWatS2xJRArf/Vr50bVz7zCmCrArA7Zae+gQ8gY4mVJOXwfPxIHnRbs5XhPK0E/ XKkaAny6YTjV51SHiFkEcj7FRjAEOPHw/jnGf4yukgQhua064tmOKw7gNi7eYyt4paHJ 2nrWaxHEXWAjVmBwIM7j/oCdyIVLDuVwgbO3Viknjk7/OoE9N86CZcGDz6TsGS2k5q+D 5glu9bUs1/fTPdAoFY9CEdZ/F/+nVKjBO5PNAF++1EjJbIKPdoqJ5h9Hy60tF0jGCcNq hpRQ==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=teG3vyr3; arc=pass (i=1); spf=pass (google.com: domain of libc-alpha-bounces~patch=linaro.org@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="libc-alpha-bounces~patch=linaro.org@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from server2.sourceware.org (server2.sourceware.org. [2620:52:3:1:0:246e:9693:128c]) by mx.google.com with ESMTPS id d75a77b69052e-44fe84267e6si23679811cf.602.2024.07.25.11.44.17 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 11:44:17 -0700 (PDT) Received-SPF: pass (google.com: domain of libc-alpha-bounces~patch=linaro.org@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) client-ip=2620:52:3:1:0:246e:9693:128c; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=teG3vyr3; arc=pass (i=1); spf=pass (google.com: domain of libc-alpha-bounces~patch=linaro.org@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="libc-alpha-bounces~patch=linaro.org@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 100453858294 for ; Thu, 25 Jul 2024 18:44:17 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-pf1-x430.google.com (mail-pf1-x430.google.com [IPv6:2607:f8b0:4864:20::430]) by sourceware.org (Postfix) with ESMTPS id 9039C3858C31 for ; Thu, 25 Jul 2024 18:44:02 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 9039C3858C31 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=linaro.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 9039C3858C31 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::430 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1721933045; cv=none; b=rRhTyAd9ql8vMYowdk0aHL3+vcAoD1NBoeQBVNUyBq0tsrLAgNxooJqWCAEq8FbtmW4a6YL/OPbU7w5jSe6xdNkT37ahe/tI3JeQ0o0epAlh0Be6BDr/Sl1QYQ5VpaaJhG1p+rxJldGMq2Fa5MweEhMIVHdQgl+npvo40B6b6vI= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1721933045; c=relaxed/simple; bh=w+O00U1RVNAjyPvA/WnNBM9vZM8zd9uZIccItxND4/M=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=xwMm5xMHKq7x0W207LD3biuNbNyaZx8s6hXZnFlxlHgiAqdxwdSSLZ1yeehRcA8jF11W+qOlfdk+HCtsuZJi7x2Ai2OfWnQ3c8GaqQZF/lG+NlHAp1yVxANTkVSItSciV6eIKyl1ukcOaPBKK9Hq3cgg4ydmJ7GPP/aW+B2qox0= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pf1-x430.google.com with SMTP id d2e1a72fcca58-70d316f0060so103404b3a.1 for ; Thu, 25 Jul 2024 11:44:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1721933041; x=1722537841; darn=sourceware.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=RiQR1VnwchEEdjoqyJT9Jgl9B4NI8Rr04drzFTo4IQA=; b=teG3vyr3EPQUe1xOJdNhjH+7/v927XfVX33lj3nAAD+uAd0S10nj0kbOBmQC+hp9fO H08Bg5QP28irYkFK9k1UxQ7f1GpLvAdK/7SQZn0ELVTuDBNtnqPpQFAWbVegy1XLFOGm V+Vn+qsU5YbOgPxfMEMEiFM6sJC5tgAH7jj3zyfNALatfZYYDbheVTLZbgp5SwLAkCCR mtQQgQiPNl19MvUS3dMrMm3Wj160dpPOMQ3y9QnBvsr9VJwkpf03qhTFuNenRNg8nVIM CkNiwN504RJmquQd6rkhG/EOkQJ11Gn2fo/8rZobuxB7OwKO2+fGSsay2yI0C2rpC+R+ 6lHg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721933041; x=1722537841; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=RiQR1VnwchEEdjoqyJT9Jgl9B4NI8Rr04drzFTo4IQA=; b=kbevrRc2rSDz55OFIBZIiWAvf1vbHQz5gfsJ/cQXJX/RhwAVD667ZSZr3Dx4hpAOh0 fuy+rZCpWMiJg2MhEGqiJMI1mxQWzImS5GlVSwonYBEdNjKC0wupaQaLEebIsgXCU7+L E1SiyeJ90NEZMA92IV0SXYAsj8v3axusjGQ5v0gRLreDUOs5gE0oaWUwFJ3fDTiIEMNr 7FxrKoGGR8WKNP1MSNERcz/EpKSaxdiHfJS0T1bHSQdJW3vNKpj3NStb062LjqLo/Szs 38AEt3VuR7/PLI5utlvLCmsYYLZzb0E4K48jf6/OP0ii1rOu0VYDeEpowBD4HRd4quyZ 5vIg== X-Gm-Message-State: AOJu0YxZPln7z/XIy1FbAkoMWmg3pHuhfsIxuV3chSjpb/gDegBbzhWL VUuuukQ+unXlIM8woTZuXU4fwT4z+9+ZFx83mLsYf3oh6YLEcZpffBQEmlJR77c6T3okhmGn8hR X X-Received: by 2002:a05:6a20:2589:b0:1c0:e69f:f23e with SMTP id adf61e73a8af0-1c473eaa1edmr6213028637.9.1721933040907; Thu, 25 Jul 2024 11:44:00 -0700 (PDT) Received: from mandiga.. ([2804:1b3:a7c1:1944:71e3:2ede:b2a5:f38e]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8745f2sm1431656b3a.159.2024.07.25.11.43.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 11:44:00 -0700 (PDT) From: Adhemerval Zanella To: libc-alpha@sourceware.org Cc: Zack Weinberg Subject: [PATCH] stdlib: Allow concurrent exit (BZ 31997) Date: Thu, 25 Jul 2024 15:41:44 -0300 Message-ID: <20240725184356.27086-1-adhemerval.zanella@linaro.org> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-Spam-Status: No, score=-12.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, KAM_SHORT, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces~patch=linaro.org@sourceware.org Even if C/POSIX standard states that exit is not formally thread-unsafe, calling it more than once is UB. The glibc already supports it for the single-thread, and both elf/nodelete2.c and tst-rseq-disable.c call exit from a DSO destructor (which is called by _dl_fini, registered at program startup with __cxa_atexit). However, there are still race issues when it is called more than once concurrently by multiple threads. A recent Rust PR triggered this issue [1], which resulted in an Austin Group ask for clarification [2]. Besides it, there is a discussion to make concurrent calling not UB [3], wtiha defined semantic where any remaining callers block until the first call to exit has finished (reentrant calls, leaving through longjmp, and exceptions are still undefined). For glibc, at least reentrant calls are required to be supported to avoid changing the current behaviour. This requires locking using a recursive lock, where any exit called by atexit() handlers resumes at the point of the current handler (thus avoiding calling the current handle multiple times). Checked on x86_64-linux-gnu and aarch64-linux-gnu. [1] https://github.com/rust-lang/rust/issues/126600 [2] https://austingroupbugs.net/view.php?id=1845 [3] https://www.openwall.com/lists/libc-coord/2024/07/24/4 Reviewed-by: Carlos O'Donell --- stdlib/Makefile | 1 + stdlib/exit.c | 8 ++ stdlib/tst-concurrent-exit.c | 157 +++++++++++++++++++++++++++++++++++ 3 files changed, 166 insertions(+) create mode 100644 stdlib/tst-concurrent-exit.c diff --git a/stdlib/Makefile b/stdlib/Makefile index 8b0ac63ddb..7eec68b73a 100644 --- a/stdlib/Makefile +++ b/stdlib/Makefile @@ -273,6 +273,7 @@ tests := \ tst-bsearch \ tst-bz20544 \ tst-canon-bz26341 \ + tst-concurrent-exit \ tst-cxa_atexit \ tst-environ \ tst-getrandom \ diff --git a/stdlib/exit.c b/stdlib/exit.c index 5166c78044..bbaf138806 100644 --- a/stdlib/exit.c +++ b/stdlib/exit.c @@ -132,9 +132,17 @@ __run_exit_handlers (int status, struct exit_function_list **listp, } +/* The lock handles concurrent exit(), even though the C/POSIX standard states + that calling exit() more than once is UB. The recursive lock allows + atexit() handlers or destructors to call exit() itself. In this case, the + handler list execution will resume at the point of the current handler. */ +__libc_lock_define_initialized_recursive (static, __exit_lock) + void exit (int status) { + /* The exit should never return, so there is no need to unlock it. */ + __libc_lock_lock_recursive (__exit_lock); __run_exit_handlers (status, &__exit_funcs, true, true); } libc_hidden_def (exit) diff --git a/stdlib/tst-concurrent-exit.c b/stdlib/tst-concurrent-exit.c new file mode 100644 index 0000000000..6cc9e32777 --- /dev/null +++ b/stdlib/tst-concurrent-exit.c @@ -0,0 +1,157 @@ +/* Check if exit can be called concurrently by multiple threads. + Copyright (C) 2024 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include +#include + +#define MAX_atexit 32 + +static pthread_barrier_t barrier; + +static void * +tf (void *closure) +{ + xpthread_barrier_wait (&barrier); + exit (0); + + return NULL; +} + +static const char expected[] = "00000000000000000000000003021121130211"; +static char crumbs[sizeof (expected)]; +static int next_slot = 0; + +static void +exit_with_flush (int code) +{ + fflush (stdout); + /* glibc allows recursive exit, the atexit handlers execution will be + resumed from the where the previous exit was interrrupted. */ + exit (code); +} + +/* Take some time, so another thread potentially issue exit. */ +#define SETUP_NANOSLEEP \ + if (nanosleep (&(struct timespec) { .tv_sec = 0, .tv_nsec = 1000L }, \ + NULL) != 0) \ + FAIL_EXIT1 ("nanosleep: %m") + +static void +fn0 (void) +{ + crumbs[next_slot++] = '0'; + SETUP_NANOSLEEP; +} + +static void +fn1 (void) +{ + crumbs[next_slot++] = '1'; + SETUP_NANOSLEEP; +} + +static void +fn2 (void) +{ + crumbs[next_slot++] = '2'; + atexit (fn1); + SETUP_NANOSLEEP; +} + +static void +fn3 (void) +{ + crumbs[next_slot++] = '3'; + atexit (fn2); + atexit (fn0); + SETUP_NANOSLEEP; +} + +static void +fn_final (void) +{ + TEST_COMPARE_STRING (crumbs, expected); + exit_with_flush (0); +} + +_Noreturn static void +child (void) +{ + enum { nthreads = 8 }; + + xpthread_barrier_init (&barrier, NULL, nthreads + 1); + + pthread_t thr[nthreads]; + for (int i = 0; i < nthreads; i++) + thr[i] = xpthread_create (NULL, tf, NULL); + + xpthread_barrier_wait (&barrier); + + for (int i = 0; i < nthreads; i++) + { + pthread_join (thr[i], NULL); + /* It should not be reached, it means that thread did not exit for + some reason. */ + support_record_failure (); + } + + exit (2); +} + +static int +do_test (void) +{ + /* Register a large number of handler that will trigger a heap allocation + for the handle state. On exit, each block will be freed after the + handle is processed. */ + int slots_remaining = MAX_atexit; + + /* Register this first so it can verify expected order of the rest. */ + atexit (fn_final); --slots_remaining; + + TEST_VERIFY_EXIT (atexit (fn1) == 0); --slots_remaining; + TEST_VERIFY_EXIT (atexit (fn3) == 0); --slots_remaining; + TEST_VERIFY_EXIT (atexit (fn1) == 0); --slots_remaining; + TEST_VERIFY_EXIT (atexit (fn2) == 0); --slots_remaining; + TEST_VERIFY_EXIT (atexit (fn1) == 0); --slots_remaining; + TEST_VERIFY_EXIT (atexit (fn3) == 0); --slots_remaining; + + while (slots_remaining > 0) + { + TEST_VERIFY_EXIT (atexit (fn0) == 0); --slots_remaining; + } + + pid_t pid = xfork (); + if (pid != 0) + { + int status; + xwaitpid (pid, &status, 0); + TEST_VERIFY (WIFEXITED (status)); + } + else + child (); + + return 0; +} + +#include