[Bug sanitizer/77982] New: deadlock in asan thread initialization/interception.

["pawel_sikora at zoho dot com" <gcc-bugzilla at gcc dot gnu dot org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77982

            Bug ID: 77982
           Summary: deadlock in asan thread initialization/interception.
           Product: gcc
           Version: 6.2.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: pawel_sikora at zoho dot com
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org
  Target Milestone: ---

hi,

afaics there's a lock scenario in asan initialization code.

my application uses dlopen() to load shared lib which creates a thread at the
global initialization stage (in details, the static version of libusb linked in
a shared lib creates a thread for usb polling). this thread creation is
intercepted by asan and stuck in endless loop:

255├>    while (atomic_load(&param.is_registered, memory_order_acquire) == 0)
256│       internal_sched_yield();

Thread 1 (Thread 0x7f4aee0937c0 (LWP 17702)):
#0  __sanitizer::internal_sched_yield () at
../../../../libsanitizer/sanitizer_common/sanitizer_linux.cc:304
#1  0x00007f4aefafe075 in __interceptor_pthread_create (thread=0x7f4ae0ede718
<poll_libusb_thread>, attr=<optimized out>, start_routine=0x7f4ae0d17285
<poll_async_libusb>, arg=0x0) at ../../../../libsanitizer/as
an/asan_interceptors.cc:256
#2  0x00007f4ae0d1734c in my_init () from
/home/pawels/ssd/dvm/gcc-6/cmake-debug-x86_64-gnu-linux/bin64/libhesapi.so
#3  0x00007f4af0a77d8a in call_init (l=<optimized out>, argc=argc@entry=2,
argv=argv@entry=0x7ffd27a16478, env=env@entry=0x7ffd27a16490) at dl-init.c:72
#4  0x00007f4af0a77e9b in call_init (env=0x7ffd27a16490, argv=0x7ffd27a16478,
argc=2, l=<optimized out>) at dl-init.c:30
#5  _dl_init (main_map=main_map@entry=0x61a000014a80, argc=2,
argv=0x7ffd27a16478, env=0x7ffd27a16490) at dl-init.c:120
#6  0x00007f4af0a7ca91 in dl_open_worker (a=a@entry=0x7ffd27a13e60) at
dl-open.c:564
#7  0x00007f4af0a77c34 in _dl_catch_error
(objname=objname@entry=0x7ffd27a13e50,
errstring=errstring@entry=0x7ffd27a13e58,
mallocedp=mallocedp@entry=0x7ffd27a13e4f, operate=operate@entry=0x7f4af0a7c640
<dl_open_
worker>, args=args@entry=0x7ffd27a13e60) at dl-error.c:187
#8  0x00007f4af0a7bfe9 in _dl_open (file=0x610000006358
"/home/pawels/ssd/dvm/gcc-6/cmake-debug-x86_64-gnu-linux/bin64/libBoardDetector.so",
mode=-2147483391, caller_dlopen=0x7f4aefb12e65 <__interceptor_dlopen(c
har const*, int)+101>, nsid=-2, argc=<optimized out>, argv=<optimized out>,
env=0x7ffd27a16490) at dl-open.c:649
#9  0x00007f4aef57df09 in dlopen_doit (a=a@entry=0x7ffd27a14090) at dlopen.c:66
#10 0x00007f4af0a77c34 in _dl_catch_error (objname=0x7f4af00131b0
<alloc_memory_for_dlsym+16>, errstring=0x7f4af00131b8
<alloc_memory_for_dlsym+24>, mallocedp=0x7f4af00131a8
<alloc_memory_for_dlsym+8>, operate=0
x7f4aef57deb0 <dlopen_doit>, args=0x7ffd27a14090) at dl-error.c:187
#11 0x00007f4aef57e591 in _dlerror_run (operate=operate@entry=0x7f4aef57deb0
<dlopen_doit>, args=args@entry=0x7ffd27a14090) at dlerror.c:163
#12 0x00007f4aef57dfa2 in __dlopen (file=<optimized out>, mode=<optimized out>)
at dlopen.c:87
#13 0x00007f4aefb12e65 in __interceptor_dlopen (filename=0x610000006358
"/home/pawels/ssd/dvm/gcc-6/cmake-debug-x86_64-gnu-linux/bin64/libBoardDetector.so",
flag=flag@entry=257) at ../../../../libsanitizer/sanit
izer_common/sanitizer_common_interceptors.inc:4968
#14 0x00007f4af0b7d1e7 in au::system::openLibrary (libname=...) at
../sources/au/auSystemUnix.cpp:69


from the others side, the asan thread initialization stuck on the internal
libc/libdl mutex:

/usr/src/debug/glibc-2.23-81-g2eda04e/elf/dl-tls.c

765├>      __rtld_lock_lock_recursive (GL(dl_load_lock));

[Switching to thread 6 (Thread 0x7f4ae0b6c700 (LWP 17707))]
(gdb) bt
#0  __lll_lock_wait () at ../sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:135
#1  0x00007f4aee823a76 in __GI___pthread_mutex_lock (mutex=0x7f4af0c8c908
<_rtld_local+2312>) at ../nptl/pthread_mutex_lock.c:115
#2  0x00007f4af0a7a6da in tls_get_addr_tail (ti=0x7f4aefdf1b78,
dtv=0x613000008c50, the_map=0x7f4af0c8a878) at dl-tls.c:765
#3  0x00007f4aefafe9cb in __interceptor___tls_get_addr (arg=0x7f4aefdf1b78) at
../../../../libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:4207
#4  0x00007f4aefbb0b34 in __lsan::DisabledInThisThread () at
../../../../libsanitizer/lsan/lsan_common.cc:33
#5  0x00007f4aefaf8515 in __asan::Allocator::Allocate (this=0x7f4aefdf5620
<__asan::instance>, size=<optimized out>, alignment=<optimized out>,
stack=0x7f4ae0b6b430, alloc_type=<optimized out>, can_fill=<optimiz
ed out>) at ../../../../libsanitizer/asan/asan_allocator.cc:449
#6  0x00007f4aefb8f062 in __interceptor_realloc (ptr=ptr@entry=0x0,
size=size@entry=32) at ../../../../libsanitizer/asan/asan_malloc_linux.cc:83
#7  0x00007f4aee823035 in pthread_getattr_np (thread_id=<optimized out>,
attr=attr@entry=0x7f4ae0b6bd70) at pthread_getattr_np.c:161
#8  0x00007f4aefba6eed in __sanitizer::GetThreadStackTopAndBottom
(at_initialization=at_initialization@entry=false,
stack_top=stack_top@entry=0x7f4ae0b6bdf0,
stack_bottom=stack_bottom@entry=0x7f4ae0b6bdf8) at ..
/../../../libsanitizer/sanitizer_common/sanitizer_linux_libcdep.cc:112
#9  0x00007f4aefba735c in __sanitizer::GetThreadStackAndTls (main=<optimized
out>, stk_addr=stk_addr@entry=0x7f4ae0351020,
stk_size=stk_size@entry=0x7f4ae0351028, tls_addr=tls_addr@entry=0x7f4ae0351030,
tls_size
=tls_size@entry=0x7f4ae0b6be38) at
../../../../libsanitizer/sanitizer_common/sanitizer_linux_libcdep.cc:388
#10 0x00007f4aefb9b095 in __asan::AsanThread::SetThreadStackAndTls
(this=this@entry=0x7f4ae0351000) at
../../../../libsanitizer/asan/asan_thread.cc:197
#11 0x00007f4aefb9b292 in __asan::AsanThread::Init
(this=this@entry=0x7f4ae0351000) at
../../../../libsanitizer/asan/asan_thread.cc:153
#12 0x00007f4aefb9b438 in __asan::AsanThread::ThreadStart (this=0x7f4ae0351000,
os_id=17707, signal_thread_is_registered=0x7ffd27a13338) at
../../../../libsanitizer/asan/asan_thread.cc:166
#13 0x00007f4aee8215ca in start_thread (arg=0x7f4ae0b6c700) at
pthread_create.c:333
#14 0x00007f4aee559f6d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:109