threads/126950: rtld malloc is thread-unsafe

[agile at sunbay.com]

The following reply was made to PR threads/126950; it has been noted by GNATS.

From: agile at sunbay.com
To: bug-followup at FreeBSD.org
Cc:  
Subject: Re: threads/126950: rtld malloc is thread-unsafe
Date: Mon, 1 Sep 2008 11:58:30 +0300 (EEST)

 ------=_20080901115830_71529
 Content-Type: text/plain; charset="utf8"
 Content-Transfer-Encoding: 8bit
 
 patch for 7.0-RELEASE
 ------=_20080901115830_71529
 Content-Type: text/plain; name="126950.patch.txt"
 Content-Transfer-Encoding: 8bit
 Content-Disposition: attachment; filename="126950.patch.txt"
 
 diff -ur /usr/src/libexec/rtld-elf/rtld.c /usr/src/libexec/rtld-elf/rtld.c
 --- /usr/src/libexec/rtld-elf/rtld.c	2008-09-01 11:29:15.000000000 +0300
 +++ /usr/src/libexec/rtld-elf/rtld.c	2008-09-01 11:29:15.000000000 +0300
 @@ -107,7 +107,7 @@
  static Obj_Entry *load_object(const char *, const Obj_Entry *);
  static Obj_Entry *obj_from_addr(const void *);
  static void objlist_call_fini(Objlist *, int *lockstate, unsigned long *gen);
 -static void objlist_call_init(Objlist *);
 +static void objlist_call_init(Objlist *, int *lockstate);
  static void objlist_clear(Objlist *);
  static Objlist_Entry *objlist_find(Objlist *, const Obj_Entry *);
  static void objlist_init(Objlist *);
 @@ -513,8 +513,8 @@
  
      r_debug_state(NULL, &obj_main->linkmap); /* say hello to gdb! */
  
 -    objlist_call_init(&initlist);
      lockstate = wlock_acquire(rtld_bind_lock);
 +    objlist_call_init(&initlist, &lockstate);
      objlist_clear(&initlist);
      wlock_release(rtld_bind_lock, lockstate);
  
 @@ -1473,7 +1473,7 @@
   * functions.
   */
  static void
 -objlist_call_init(Objlist *list)
 +objlist_call_init(Objlist *list, int *lockstate)
  {
      Objlist_Entry *elm, *elm_tmp;
      char *saved_msg;
 @@ -1483,6 +1483,7 @@
       * call into the dynamic linker and overwrite it.
       */
      saved_msg = errmsg_save();
 +    wlock_release(rtld_bind_lock, *lockstate);
      STAILQ_FOREACH_SAFE(elm, list, link, elm_tmp) {
  	dbg("calling init function for %s at %p", elm->obj->path,
  	    (void *)elm->obj->init);
 @@ -1490,6 +1491,7 @@
  	    elm->obj->path);
  	call_initfini_pointer(elm->obj, elm->obj->init);
      }
 +    *lockstate = wlock_acquire(rtld_bind_lock);
      errmsg_restore(saved_msg);
  }
  
 @@ -1775,7 +1777,7 @@
      if (root->refcount == 0) {
  	/*
  	 * The object is no longer referenced, so we must unload it.
 -	 * First, call the fini functions with no locks held.
 +	 * First, call the fini functions.
  	 */
  	objlist_call_fini(&list_fini, &lockstate, &list_fini_gen);
  
 @@ -1890,10 +1892,8 @@
  	name);
      GDB_STATE(RT_CONSISTENT,obj ? &obj->linkmap : NULL);
  
 -    /* Call the init functions with no locks held. */
 -    wlock_release(rtld_bind_lock, lockstate);
 -    objlist_call_init(&initlist);
 -    lockstate = wlock_acquire(rtld_bind_lock);
 +    /* Call the init functions. */
 +    objlist_call_init(&initlist, &lockstate);
      objlist_clear(&initlist);
      wlock_release(rtld_bind_lock, lockstate);
      return obj;
 ------=_20080901115830_71529--