Discussion:
[1003.1(2013)/Issue7+TC1 0000863]: Explicitly disallow longjmp from pthread_once init_routine
Austin Group Bug Tracker
2014-08-05 22:09:46 UTC
Permalink
The following issue has been SUBMITTED.
======================================================================
http://austingroupbugs.net/view.php?id=863
======================================================================
Reported By: dalias
Assigned To:
======================================================================
Project: 1003.1(2013)/Issue7+TC1
Issue ID: 863
Category: System Interfaces
Type: Clarification Requested
Severity: Editorial
Priority: normal
Status: New
Name: Rich Felker
Organization: musl libc
User Reference:
Section: pthread_once
Page Number: unknown
Line Number: unknown
Interp Status: ---
Final Accepted Text:
======================================================================
Date Submitted: 2014-08-05 22:09 UTC
Last Modified: 2014-08-05 22:09 UTC
======================================================================
Summary: Explicitly disallow longjmp from pthread_once
init_routine
Description:
As written, the specification for pthread_once assumes that init_routine
either returns or acts on thread cancellation. However, there is a third
possibility which is unaddressed: that execution of init_routine ends with
a call to longjmp.

Based on a strict reading of the specification, I think the requirement
here is that all subsequent calls to pthread_once (with the same
once_control) deadlock if the init_routine ended with longjmp. This is
because:

A. "Subsequent calls of pthread_once() with the same once_control shall not
call the init_routine." and this requirement is only relaxed when
init_routine is cancelled: "if init_routine is a cancellation point and is
canceled, the effect on once_control shall be as if pthread_once() was
never called." Thus subsequent calls after the first ended by longjmp
cannot call the init_routine again.

B. "On return from pthread_once(), init_routine shall have completed."
Thus, subsequent calls after the first ended by longjmp cannot return,
since init_routine has not completed.

However, I don't think this behavior is useful, and allowing longjmp at all
it makes it difficult to implement pthread_once, since the natural way of
handling cancellation uses pthread_cleanup_push, while longjmp out of a
pthread_cleanup_push context is not permitted.

Note that allowing longjmp and having pthread_once behave the same way when
init_routine ends with longjmp as it does when init_routine is cancelled
does not seem like a viable option. In order for this to work, longjmp must
be implemented via some sort of unwinding that can reset the state of the
once_control object. I do not think forbidding all traditional
implementations of setjmp/longjmp as mere register save/restore is the
intent of this standard or within the scope of fixing this issue in
pthread_once.

Desired Action:
Add to the description of pthread_once:

"If init_routine calls longjmp[OB XSI][Option Start], _longjmp,[Option End]
or siglongjmp, the behavior is undefined."

======================================================================

Issue History
Date Modified Username Field Change
======================================================================
2014-08-05 22:09 dalias New Issue
2014-08-05 22:09 dalias Name => Rich Felker
2014-08-05 22:09 dalias Organization => musl libc
2014-08-05 22:09 dalias Section => pthread_once
2014-08-05 22:09 dalias Page Number => unknown
2014-08-05 22:09 dalias Line Number => unknown
======================================================================
Austin Group Bug Tracker
2014-08-06 01:24:27 UTC
Permalink
A NOTE has been added to this issue.
======================================================================
http://austingroupbugs.net/view.php?id=863
======================================================================
Reported By: dalias
Assigned To:
======================================================================
Project: 1003.1(2013)/Issue7+TC1
Issue ID: 863
Category: System Interfaces
Type: Clarification Requested
Severity: Editorial
Priority: normal
Status: New
Name: Rich Felker
Organization: musl libc
User Reference:
Section: pthread_once
Page Number: unknown
Line Number: unknown
Interp Status: ---
Final Accepted Text:
======================================================================
Date Submitted: 2014-08-05 22:09 UTC
Last Modified: 2014-08-06 01:24 UTC
======================================================================
Summary: Explicitly disallow longjmp from pthread_once
init_routine
======================================================================

----------------------------------------------------------------------
(0002333) dalias (reporter) - 2014-08-06 01:24
http://austingroupbugs.net/view.php?id=863#c2333
----------------------------------------------------------------------
I realize there are at least two related issues which should also be
addressed: recursive calls to pthread_once (where the init_routine calls
pthread_once with the same once_control object) and calling pthread_exit
from the init_routine.

My opinion is that recursive calls should be forbidden ("If init_routine
calls pthread_once with the same value of once_control that was passed to
pthread_once, the behavior is undefined.") and pthread_exit should either
behave identically to cancellation (this is the natural behavior which
would arise anyway with most implementations) or be undefined.

Issue History
Date Modified Username Field Change
======================================================================
2014-08-05 22:09 dalias New Issue
2014-08-05 22:09 dalias Name => Rich Felker
2014-08-05 22:09 dalias Organization => musl libc
2014-08-05 22:09 dalias Section => pthread_once
2014-08-05 22:09 dalias Page Number => unknown
2014-08-05 22:09 dalias Line Number => unknown
2014-08-06 01:24 dalias Note Added: 0002333
======================================================================
Austin Group Bug Tracker
2014-08-08 11:01:39 UTC
Permalink
A NOTE has been added to this issue.
======================================================================
http://austingroupbugs.net/view.php?id=863
======================================================================
Reported By: dalias
Assigned To:
======================================================================
Project: 1003.1(2013)/Issue7+TC1
Issue ID: 863
Category: System Interfaces
Type: Clarification Requested
Severity: Editorial
Priority: normal
Status: New
Name: Rich Felker
Organization: musl libc
User Reference:
Section: pthread_once
Page Number: unknown
Line Number: unknown
Interp Status: ---
Final Accepted Text:
======================================================================
Date Submitted: 2014-08-05 22:09 UTC
Last Modified: 2014-08-08 11:01 UTC
======================================================================
Summary: Explicitly disallow longjmp from pthread_once
init_routine
======================================================================

----------------------------------------------------------------------
(0002339) jilles (reporter) - 2014-08-08 11:01
http://austingroupbugs.net/view.php?id=863#c2339
----------------------------------------------------------------------
I think the desired action restricts applications too much. There should
only be undefined behavior when the call to longjmp(), _longjmp() or
siglongjmp() would terminate the call to the init_routine. This is similar
to the restrictions in the exit (atexit functions) and pthread_cleanup_pop
pages.

Pages like ftw and nftw mention the perils of terminating calls to a
callback function via longjmp() and similar in the Application Usage
section (so not normative). Perhaps this can be or is specified with
longjmp since terminating calls to any standard function's callback
function via longjmp() is not a reasonable thing to support.

Issue History
Date Modified Username Field Change
======================================================================
2014-08-05 22:09 dalias New Issue
2014-08-05 22:09 dalias Name => Rich Felker
2014-08-05 22:09 dalias Organization => musl libc
2014-08-05 22:09 dalias Section => pthread_once
2014-08-05 22:09 dalias Page Number => unknown
2014-08-05 22:09 dalias Line Number => unknown
2014-08-06 01:24 dalias Note Added: 0002333
2014-08-08 11:01 jilles Note Added: 0002339
======================================================================
Austin Group Bug Tracker
2014-08-08 13:21:07 UTC
Permalink
A NOTE has been added to this issue.
======================================================================
http://austingroupbugs.net/view.php?id=863
======================================================================
Reported By: dalias
Assigned To:
======================================================================
Project: 1003.1(2013)/Issue7+TC1
Issue ID: 863
Category: System Interfaces
Type: Clarification Requested
Severity: Editorial
Priority: normal
Status: New
Name: Rich Felker
Organization: musl libc
User Reference:
Section: pthread_once
Page Number: unknown
Line Number: unknown
Interp Status: ---
Final Accepted Text:
======================================================================
Date Submitted: 2014-08-05 22:09 UTC
Last Modified: 2014-08-08 13:21 UTC
======================================================================
Summary: Explicitly disallow longjmp from pthread_once
init_routine
======================================================================

----------------------------------------------------------------------
(0002341) steffen (reporter) - 2014-08-08 13:21
http://austingroupbugs.net/view.php?id=863#c2341
----------------------------------------------------------------------
Yes, i too wanted to note that using a longjmp(3) from just about any
call-out facility cannot be expected to leave state in sane behaviour,
which possibly should be stated more explicitly for longjmp(3) itself.

Issue History
Date Modified Username Field Change
======================================================================
2014-08-05 22:09 dalias New Issue
2014-08-05 22:09 dalias Name => Rich Felker
2014-08-05 22:09 dalias Organization => musl libc
2014-08-05 22:09 dalias Section => pthread_once
2014-08-05 22:09 dalias Page Number => unknown
2014-08-05 22:09 dalias Line Number => unknown
2014-08-06 01:24 dalias Note Added: 0002333
2014-08-08 11:01 jilles Note Added: 0002339
2014-08-08 13:21 steffen Note Added: 0002341
======================================================================
Austin Group Bug Tracker
2014-08-08 16:05:56 UTC
Permalink
A NOTE has been added to this issue.
======================================================================
http://austingroupbugs.net/view.php?id=863
======================================================================
Reported By: dalias
Assigned To:
======================================================================
Project: 1003.1(2013)/Issue7+TC1
Issue ID: 863
Category: System Interfaces
Type: Clarification Requested
Severity: Editorial
Priority: normal
Status: New
Name: Rich Felker
Organization: musl libc
User Reference:
Section: pthread_once
Page Number: unknown
Line Number: unknown
Interp Status: ---
Final Accepted Text:
======================================================================
Date Submitted: 2014-08-05 22:09 UTC
Last Modified: 2014-08-08 16:05 UTC
======================================================================
Summary: Explicitly disallow longjmp from pthread_once
init_routine
======================================================================

----------------------------------------------------------------------
(0002342) dalias (reporter) - 2014-08-08 16:05
http://austingroupbugs.net/view.php?id=863#c2342
----------------------------------------------------------------------
Indeed, that is exactly what I meant to say; I merely misstated it. I would
very much like the approach of specifying this as part of the description
of longjmp as jilles suggested; however, I fear that doing so may not align
well with ISO C. C11 added several functions which have callbacks, and at
least for call_once, it's not clear that leaving the call with longjmp is
forbidden. So this would need an interpretation from WG14 I think. As such,
I'd be happy with just fixing the description of pthread_once locally for
now, and looking for a more "global" solution to this type of problem
later, but I don't oppose trying to fix it globally now if everybody is up
for the task.

Issue History
Date Modified Username Field Change
======================================================================
2014-08-05 22:09 dalias New Issue
2014-08-05 22:09 dalias Name => Rich Felker
2014-08-05 22:09 dalias Organization => musl libc
2014-08-05 22:09 dalias Section => pthread_once
2014-08-05 22:09 dalias Page Number => unknown
2014-08-05 22:09 dalias Line Number => unknown
2014-08-06 01:24 dalias Note Added: 0002333
2014-08-08 11:01 jilles Note Added: 0002339
2014-08-08 13:21 steffen Note Added: 0002341
2014-08-08 16:05 dalias Note Added: 0002342
======================================================================
Austin Group Bug Tracker
2014-08-08 18:29:14 UTC
Permalink
A NOTE has been added to this issue.
======================================================================
http://austingroupbugs.net/view.php?id=863
======================================================================
Reported By: dalias
Assigned To:
======================================================================
Project: 1003.1(2013)/Issue7+TC1
Issue ID: 863
Category: System Interfaces
Type: Clarification Requested
Severity: Editorial
Priority: normal
Status: New
Name: Rich Felker
Organization: musl libc
User Reference:
Section: pthread_once
Page Number: unknown
Line Number: unknown
Interp Status: ---
Final Accepted Text:
======================================================================
Date Submitted: 2014-08-05 22:09 UTC
Last Modified: 2014-08-08 18:29 UTC
======================================================================
Summary: Explicitly disallow longjmp from pthread_once
init_routine
======================================================================

----------------------------------------------------------------------
(0002344) steffen (reporter) - 2014-08-08 18:29
http://austingroupbugs.net/view.php?id=863#c2344
----------------------------------------------------------------------
Cool.
But i think that if this really can't be closed by changing longjmp(3)
itself, just as Jilles suggested, so that the ftw(3), nftw(3) and
scandir(3) usage hints can be removed, then it should be considered to
change the undefined "dynamic storage" term which is used there to "dynamic
resources" or something similar, since file descriptors may also leak, of
course. I think the term "storage" isn't related to file descriptors
anywhere else.

Issue History
Date Modified Username Field Change
======================================================================
2014-08-05 22:09 dalias New Issue
2014-08-05 22:09 dalias Name => Rich Felker
2014-08-05 22:09 dalias Organization => musl libc
2014-08-05 22:09 dalias Section => pthread_once
2014-08-05 22:09 dalias Page Number => unknown
2014-08-05 22:09 dalias Line Number => unknown
2014-08-06 01:24 dalias Note Added: 0002333
2014-08-08 11:01 jilles Note Added: 0002339
2014-08-08 13:21 steffen Note Added: 0002341
2014-08-08 16:05 dalias Note Added: 0002342
2014-08-08 18:29 steffen Note Added: 0002344
======================================================================
Loading...