assertion failure in the glibc

[Justus Winter]

/* Hi :)

I believe I have found two problems in the glibc.

1. hurd_check_cancel takes 'lock', and then asserts that
   'critical_section_lock' is not taken.  However, hurd_thread_cancel
   first takes 'critical_section_lock' and then 'lock'.  This program
   demonstrates this by spinning on both functions.

2. The assertion failure actually deadlocks trying to write the
   message.

Cheers,
Justus

(gdb) thread apply all bt

Thread 3 (Thread 5428.3):
#0  0x01074a6c in swtch_pri () at 
/build/eglibc-2.18/build-tree/hurd-i386-libc/mach/swtch_pri.S:2
#1  0x01076274 in __spin_lock_solid (lock=lock@entry=0x2b00c) at spin-solid.c:26
#2  0x0108aded in __spin_lock (__lock=0x2b00c) at ../mach/lock-intern.h:54
#3  _hurd_sigstate_lock (ss=ss@entry=0x2b008) at hurdsig.c:183
#4  0x0109bcdd in _hurd_ctty_output (port=port@entry=116, ctty=ctty@entry=135, 
rpc=rpc@entry=0x19fd7d4) at ctty-output.c:42
#5  0x0109627d in _hurd_fd_write (fd=fd@entry=0x2df48, buf=buf@entry=0x19fd9c0, 
offset=-1) at fd-write.c:36
#6  0x01156a2a in __libc_write (fd=2, buf=buf@entry=0x19fd9c0, 
nbytes=nbytes@entry=134) at ../sysdeps/mach/hurd/write.c:25
#7  0x010f158b in _IO_new_file_write (f=0x1210a80 <_IO_2_1_stderr_>, 
data=0x19fd9c0, n=134) at fileops.c:1262
#8  0x010f0814 in new_do_write (fp=fp@entry=0x1210a80 <_IO_2_1_stderr_>, 
    data=data@entry=0x19fd9c0 "hurd_thread_cancel_race: thread-cancel.c:93: 
hurd_check_cancel: Assertion `! __spin_lock_locked 
(&ss->critical_section_lock)' failed.\n", to_do=to_do@entry=134) at 
fileops.c:538
#9  0x010f1c72 in _IO_new_file_xsputn (f=0x1210a80 <_IO_2_1_stderr_>, 
data=0x19fd9c0, n=134) at fileops.c:1346
#10 0x010cd266 in buffered_vfprintf (s=s@entry=0x1210a80 <_IO_2_1_stderr_>, 
format=format@entry=0x11d2f11 "%s", args=args@entry=0x19fff28 "\030\006\020") 
at vfprintf.c:2348
#11 0x010c89b5 in _IO_vfprintf_internal (s=s@entry=0x1210a80 <_IO_2_1_stderr_>, 
format=format@entry=0x11d2f11 "%s", ap=ap@entry=0x19fff28 "\030\006\020") at 
vfprintf.c:1301
#12 0x010e785e in __fxprintf (fp=0x1210a80 <_IO_2_1_stderr_>, fp@entry=0x0, 
fmt=fmt@entry=0x11d2f11 "%s") at fxprintf.c:55
#13 0x010abc02 in __assert_fail_base (fmt=0x11d63cc "%s%s%s:%u: %s%sAssertion 
`%s' failed.\n%n", assertion=assertion@entry=0x11d5a04 "! __spin_lock_locked 
(&ss->critical_section_lock)", 
    file=file@entry=0x11d05ba "thread-cancel.c", line=line@entry=93, 
function=function@entry=0x11d05ca <__PRETTY_FUNCTION__.7056> 
"hurd_check_cancel") at assert.c:64
#14 0x010abd37 in __assert_fail (assertion=assertion@entry=0x11d5a04 "! 
__spin_lock_locked (&ss->critical_section_lock)", file=file@entry=0x11d05ba 
"thread-cancel.c", line=line@entry=93, 
    function=function@entry=0x11d05ca <__PRETTY_FUNCTION__.7056> 
"hurd_check_cancel") at assert.c:101
#15 0x010916aa in hurd_check_cancel () at thread-cancel.c:93
#16 0x08048652 in thread_start (arg=0x0) at hurd_thread_cancel_race.c:11
#17 0x01049aa6 in entry_point (self=0x804afc0, start_routine=0x804863d 
<thread_start>, arg=0x0) at ./pthread/pt-create.c:63
#18 0x00000000 in ?? ()

Thread 2 (Thread 5428.2):
#0  0x01074a0c in mach_msg_trap () at 
/build/eglibc-2.18/build-tree/hurd-i386-libc/mach/mach_msg_trap.S:2
#1  0x010751ee in __mach_msg (msg=msg@entry=0x17fdf20, option=option@entry=3, 
send_size=32, rcv_size=rcv_size@entry=4096, rcv_name=rcv_name@entry=125, 
timeout=timeout@entry=0, notify=notify@entry=0) at msg.c:110
#2  0x010758af in __mach_msg_server_timeout (demux=demux@entry=0x1085c90 
<msgport_server>, max_size=max_size@entry=4096, rcv_name=rcv_name@entry=125, 
option=option@entry=0, timeout=timeout@entry=0)
    at msgserver.c:150
#3  0x0107599b in __mach_msg_server (demux=demux@entry=0x1085c90 
<msgport_server>, max_size=4096, rcv_name=125) at msgserver.c:195
#4  0x01085d7d in _hurd_msgport_receive () at msgportdemux.c:67
#5  0x01049aa6 in entry_point (self=0x804a548, start_routine=0x1085d20 
<_hurd_msgport_receive>, arg=0x0) at ./pthread/pt-create.c:63
#6  0x00000000 in ?? ()

Thread 1 (Thread 5428.1):
#0  0x01074a6c in swtch_pri () at 
/build/eglibc-2.18/build-tree/hurd-i386-libc/mach/swtch_pri.S:2
#1  0x01076274 in __spin_lock_solid (lock=0x126400c) at spin-solid.c:26
#2  0x0108ae0f in __spin_lock (__lock=<optimized out>) at 
../mach/lock-intern.h:54
#3  _hurd_sigstate_lock (ss=ss@entry=0x2b008) at hurdsig.c:182
#4  0x01091461 in _hurd_critical_section_unlock (our_lock=0x2b008) at 
../hurd/hurd/signal.h:246
#5  hurd_thread_cancel (thread=137) at thread-cancel.c:81
#6  0x080486bf in main (argc=1, argv=0x15ffd24) at hurd_thread_cancel_race.c:25

*/

#include <mach.h>
#include <stdio.h>
#include <pthread.h>

thread_t thread;

static void *
thread_start(void *arg)
{
  thread = mach_thread_self ();
  while (1) hurd_check_cancel ();
  return NULL;
}

int
main(int argc, char *argv[])
{
  pthread_t pthread;
  int s;
  s = pthread_create(&pthread, NULL, &thread_start, NULL);
  if (s != 0) return 1;

  while (thread == 0) /* didum */;
  printf ("spinning on hurd_thread_cancel (%d)\n", thread);
  while (1) hurd_thread_cancel (thread);
  return 0;
}