[Bug 1907969] [NEW] linux-user/i386: Segfault when mixing threads and signals

* [Bug 1907969] [NEW] linux-user/i386: Segfault when mixing threads and signals
@ 2020-12-13 16:23 The Lemon Man
  2020-12-16  8:59 ` [Bug 1907969] " The Lemon Man
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: The Lemon Man @ 2020-12-13 16:23 UTC (permalink / raw)
  To: qemu-devel

Public bug reported:

Given the following C program, qemu-i386 will surely and certainly segfault when executing it.
The problem is only noticeable if the program is statically linked to musl's libc and, as written
in the title, it only manifests when targeting i386.

Removing the pthread calls or the second raise() makes it not segfault.

The crash is in some part of the TCG-generated code, right when it tries to perform a
%gs-relative access.

If you want a quick way of cross-compiling this binary:

* Download a copy of the Zig compiler from https://ziglang.org/download/
* Compile it with
  `zig cc -target i386-linux-musl <C-FILE> -o <OUT>`

```
#include <pthread.h>
#include <signal.h>
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <unistd.h>
#include <asm/prctl.h>
#include <sys/syscall.h>

void sig_func(int sig)
{
    write(1, "hi!\n", strlen("hi!\n"));
}

void func(void *p) { }

typedef void *(*F)(void *);

int main()
{
    pthread_t tid;

    struct sigaction action;
    action.sa_flags = 0;
    action.sa_handler = sig_func;

    if (sigaction(SIGUSR1, &action, NULL) == -1) {
        return 1;
    }

    // This works.
    raise(SIGUSR1);

    pthread_create(&tid, NULL, (F)func, NULL);
    pthread_join(tid, NULL);

    // This makes qemu segfault.
    raise(SIGUSR1);
}
```

** Affects: qemu
     Importance: Undecided
         Status: New

** Attachment added: "Compiled static binary"
   https://bugs.launchpad.net/bugs/1907969/+attachment/5443145/+files/muslt

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1907969

Title:
  linux-user/i386: Segfault when mixing threads and signals

Status in QEMU:
  New

Bug description:
  Given the following C program, qemu-i386 will surely and certainly segfault when executing it.
  The problem is only noticeable if the program is statically linked to musl's libc and, as written
  in the title, it only manifests when targeting i386.

  Removing the pthread calls or the second raise() makes it not
  segfault.

  The crash is in some part of the TCG-generated code, right when it tries to perform a
  %gs-relative access.

  If you want a quick way of cross-compiling this binary:

  * Download a copy of the Zig compiler from https://ziglang.org/download/
  * Compile it with
    `zig cc -target i386-linux-musl <C-FILE> -o <OUT>`

  ```
  #include <pthread.h>
  #include <signal.h>
  #include <stdio.h>
  #include <string.h>
  #include <sys/types.h>
  #include <unistd.h>
  #include <asm/prctl.h>
  #include <sys/syscall.h>

  void sig_func(int sig)
  {
      write(1, "hi!\n", strlen("hi!\n"));
  }

  void func(void *p) { }

  typedef void *(*F)(void *);

  int main()
  {
      pthread_t tid;

      struct sigaction action;
      action.sa_flags = 0;
      action.sa_handler = sig_func;

      if (sigaction(SIGUSR1, &action, NULL) == -1) {
          return 1;
      }

      // This works.
      raise(SIGUSR1);

      pthread_create(&tid, NULL, (F)func, NULL);
      pthread_join(tid, NULL);

      // This makes qemu segfault.
      raise(SIGUSR1);
  }
  ```

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1907969/+subscriptions

^ permalink raw reply	[flat|nested] 5+ messages in thread