Skip to content

Free Dyninst lock before unloading the RT library in test_thread_1#272

Open
bbiiggppiigg wants to merge 1 commit into
masterfrom
fix-test-thread-1-rtlib-teardown
Open

Free Dyninst lock before unloading the RT library in test_thread_1#272
bbiiggppiigg wants to merge 1 commit into
masterfrom
fix-test-thread-1-rtlib-teardown

Conversation

@bbiiggppiigg

Copy link
Copy Markdown
Member

func1_1() called dlclose(RTlib) before invoking DYNINSTfree_thelock, which is a function pointer resolved via dlsym into that same library. If the dlopen'd handle was the last reference (i.e., it did not resolve to the copy Dyninst injected), dlclose unmaps the library and the subsequent call jumps into unmapped memory, crashing the mutatee with SIGSEGV. This matches the sporadic signal-11 failures seen for test_thread_1.

Free the lock while the library is still mapped, then dlclose.

func1_1() called dlclose(RTlib) before invoking DYNINSTfree_thelock,
which is a function pointer resolved via dlsym into that same library.
If the dlopen'd handle was the last reference (i.e., it did not resolve
to the copy Dyninst injected), dlclose unmaps the library and the
subsequent call jumps into unmapped memory, crashing the mutatee with
SIGSEGV. This matches the sporadic signal-11 failures seen for
test_thread_1.

Free the lock while the library is still mapped, then dlclose.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@hainest

hainest commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Derp. I broke that in #228 when I added the destruction of the lock. Not sure how I missed that I added it after unloading the rtlib...

Have you tested this anywhere?

@bbiiggppiigg

Copy link
Copy Markdown
Member Author

@hainest
I've tested it on coriander, but the fix is not enough.
The real fix seems to be a race condition in process tear down in proccontrol.

@hainest

hainest commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

@hainest I've tested it on coriander, but the fix is not enough. The real fix seems to be a race condition in process tear down in proccontrol.

That's quite possible. proccontrol is a quagmire. There are so many times that a test will hang that I have a pkill -r 'test_*' in my testing script. I'm almost completely convinced it's tc_lock_lock in the runtime. They just use a dead simple spin lock without any backoff mechanism. We could replace that whole business with a futex (at least on linux).

@bbiiggppiigg bbiiggppiigg requested a review from hainest July 8, 2026 20:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants