From patchwork Tue May 12 13:47:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Schwab X-Patchwork-Id: 1288465 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=sourceware.org; envelope-from=libc-alpha-bounces@sourceware.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=suse.de Received: from sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 49Lzcx4tGtz9sRf for ; Tue, 12 May 2020 23:47:13 +1000 (AEST) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 129AB383F843; Tue, 12 May 2020 13:47:11 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) by sourceware.org (Postfix) with ESMTPS id 8513B383F841 for ; Tue, 12 May 2020 13:47:08 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 8513B383F841 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=suse.de Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=schwab@suse.de X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id CFB6BAE7D for ; Tue, 12 May 2020 13:47:09 +0000 (UTC) From: Andreas Schwab To: libc-alpha@sourceware.org Subject: [PATCH] nptl: wait for pending setxid request also in detached thread (bug 25942) X-Yow: Where's SANDY DUNCAN? Date: Tue, 12 May 2020 15:47:06 +0200 Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.91 (gnu/linux) MIME-Version: 1.0 X-Spam-Status: No, score=-14.4 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_STATUS, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces@sourceware.org Sender: "Libc-alpha" There is a race between __nptl_setxid and exiting detached thread, which causes a deadlock on stack_cache_lock. The deadlock happens in this state: T1: setgroups -> __nptl_setxid (holding stack_cache_lock, waiting on cmdp->cntr == 0) T2 (detached, exiting): start_thread -> __deallocate_stack (waiting on stack_cache_lock) more threads waiting on stack_cache_lock in pthread_create For non-detached threads, start_thread waits for its own setxid handler to finish before exiting. Do this for detached threads as well. --- nptl/pthread_create.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/nptl/pthread_create.c b/nptl/pthread_create.c index afd379e89a..a43089065c 100644 --- a/nptl/pthread_create.c +++ b/nptl/pthread_create.c @@ -552,11 +552,7 @@ START_THREAD_DEFN advise_stack_range (pd->stackblock, pd->stackblock_size, (uintptr_t) pd, pd->guardsize); - /* If the thread is detached free the TCB. */ - if (IS_DETACHED (pd)) - /* Free the TCB. */ - __free_tcb (pd); - else if (__glibc_unlikely (pd->cancelhandling & SETXID_BITMASK)) + if (__glibc_unlikely (pd->cancelhandling & SETXID_BITMASK)) { /* Some other thread might call any of the setXid functions and expect us to reply. In this case wait until we did that. */ @@ -572,6 +568,11 @@ START_THREAD_DEFN pd->setxid_futex = 0; } + /* If the thread is detached free the TCB. */ + if (IS_DETACHED (pd)) + /* Free the TCB. */ + __free_tcb (pd); + /* We cannot call '_exit' here. '_exit' will terminate the process. The 'exit' implementation in the kernel will signal when the