Bug 196767 - Race-Condition in Address Santitizer (RT_PREEMPT-Kernel only?)
Summary: Race-Condition in Address Santitizer (RT_PREEMPT-Kernel only?)
Status: NEW
Alias: None
Product: Process Management
Classification: Unclassified
Component: Preemption (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: Robert Love
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-08-25 10:08 UTC by Thomas Mapson
Modified: 2017-08-25 10:09 UTC (History)
1 user (show)

See Also:
Kernel Version: 4.9.0-3-rt-amd64
Subsystem:
Regression: No
Bisected commit-id:


Attachments

Description Thomas Mapson 2017-08-25 10:08:52 UTC
(Since I do not know whether this is a bug in the realtime-kernel or the compiler, I also reported it in gcc's bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79200).


Problem:
Multiple concurrent executables hang when being built by gcc with -fsanitize=address.

Platforms:
- Debian 9 (Stretch), with its current gcc (gcc (Debian 6.3.0-18) 6.3.0 20170516) and rt-kernel (4.9.0-3-rt-amd64 #1 SMP PREEMPT RT Debian 4.9.30-2+deb9u2 (2017-06-26) x86_64).
- Debian 7 or 8, with custom-built gcc (gcc-6.3.0, gcc-5.3.0) and rt-kernel (4.6.7-rt14).

Reproduce:
To reproduce this bug, you may use the following trivial C program:

----- main.c ----
int main(int ac, char** av)
{
  return 0;
}
-----

Compile with
  gcc -fsanitize=address main.c -o main

Run multiple instances concurrently (bash):
  for i in $(seq 20000) ; do ( ./main >/dev/null 2>&1 & ) ; done ; echo "SLEEPING..." ; sleep 120

Some of the executables hang as can be seen using ps or top. The processes are reported to have state "T" (stopped, either by a job control signal or because it is being traced). Attaching gdb to one of these jobs shows that __sanitize::StopTheWorld is waiting for waitpid.

If compiled without -fsanitize=address, the above loop does not cause any of the processes to hang. Using the non-rt kernel (e.g. 4.9.0-3-amd64 shipped with Debian 9) the problem vanishes, too.

Note You need to log in before you can comment on or make changes to this bug.