mbox series

[00/15] Dynamic TLS related data race fixes

Message ID cover.1613390045.git.szabolcs.nagy@arm.com
Headers
Series Dynamic TLS related data race fixes |

Message

Szabolcs Nagy Feb. 15, 2021, 11:56 a.m. UTC 
  This series is trying to address some long standing dynamic
linker races:

19329 - race between tls access, pthread_create and dlopen
27111 - race between tls access, pthread_create and dlclose
21349 - a lazy symbol binding race (not related to TLS)
27137 - lazy tlsdesc relocation on x86 is racy

and there were a number of minor issues uncovered:

27135 - dtv gaps are not reused
27136 - dtv off-by-1 error,
27403 - aarch64 memleak on dlclose

there are related issues that are not fixed, but tried to
not make the situation worse:

16133 - tls access is not as-safe
16134 - tls allocation aborts on oom
27112 - generation count may overflow on 32 bit targets

some of the patches can be handled independently.

The set is also available in the nsz/bug19329 branch.

There are new test cases that are early in the series for now
so they can be run before the fixes.

A common theme between the races is that the GL(dl_load_lock)
lock protects various dynamic linker shared global state that
are written under that lock, but in various situations (lazy
binding, tls access, thread creation) they are read without
the lock.

An earlier analysis about bug 19329
https://sourceware.org/pipermail/libc-alpha/2020-December/121090.html

In some cases atomics is used for synchronization, this means
all accesses to that object has to be atomic even if that's
behind a lock. I think this is unnecessary and can be confusing:
https://sourceware.org/pipermail/libc-alpha/2020-December/121200.html

This patchset does not try to turn non-racy read into relaxed
atomic read.

The removal of lazy tlsdesc relocation may allow further changes
at the end.  The x86 changes were not excessively tested. I ran
the glibc tests on x86_64, i386 and aarch64 linux.

Maninder Singh (1):
  elf: Fix data race in _dl_name_match_p [BZ #21349]

Szabolcs Nagy (14):
  aarch64: free tlsdesc data on dlclose [BZ #27403]
  Add test case for [BZ #19329]
  Add a DTV setup test [BZ #27136]
  elf: Fix a DTV setup issue [BZ #27136]
  elf: Fix comments and logic in _dl_add_to_slotinfo
  elf: Refactor _dl_update_slotinfo to avoid use after free
  elf: Fix data races in pthread_create and TLS access [BZ #19329]
  elf: Use relaxed atomics for racy accesses [BZ #19329]
  elf: Fix DTV gap reuse logic [BZ #27135]
  x86_64: Avoid lazy relocation of tlsdesc [BZ #27137]
  i386: Avoid lazy relocation of tlsdesc [BZ #27137]
  x86_64: Remove lazy tlsdesc relocation related code
  i386: Remove lazy tlsdesc relocation related code
  elf: Remove lazy tlsdesc relocation related code

 elf/dl-close.c                 |  26 ++--
 elf/dl-load.c                  |  18 ++-
 elf/dl-misc.c                  |   4 +-
 elf/dl-open.c                  |  15 +--
 elf/dl-tls.c                   | 133 +++++++++++--------
 elf/tlsdeschtab.h              |  53 +-------
 nptl/Makefile                  |  25 +++-
 nptl/tst-tls7.c                |  69 ++++++++++
 nptl/tst-tls7mod-dep.c         |   1 +
 nptl/tst-tls7mod.c             |   1 +
 nptl/tst-tls8.c                |  96 ++++++++++++++
 nptl/tst-tls8mod-bad.c         |   2 +
 sysdeps/aarch64/dl-lookupcfg.h |  27 ++++
 sysdeps/aarch64/tlsdesc.c      |   1 -
 sysdeps/arm/tlsdesc.c          |   1 -
 sysdeps/i386/dl-machine.h      |  76 +++++------
 sysdeps/i386/dl-tlsdesc.S      | 156 ----------------------
 sysdeps/i386/dl-tlsdesc.h      |   6 +-
 sysdeps/i386/tlsdesc.c         | 230 ---------------------------------
 sysdeps/x86_64/dl-machine.h    |  19 ++-
 sysdeps/x86_64/dl-tlsdesc.S    | 104 ---------------
 sysdeps/x86_64/dl-tlsdesc.h    |   4 +-
 sysdeps/x86_64/tlsdesc.c       | 108 ----------------
 23 files changed, 393 insertions(+), 782 deletions(-)
 create mode 100644 nptl/tst-tls7.c
 create mode 100644 nptl/tst-tls7mod-dep.c
 create mode 100644 nptl/tst-tls7mod.c
 create mode 100644 nptl/tst-tls8.c
 create mode 100644 nptl/tst-tls8mod-bad.c
 create mode 100644 sysdeps/aarch64/dl-lookupcfg.h