[SRU] pthread_rwlock_trywrlock results in hang

Bug #1864864 reported by Ondřej Surý
32
This bug affects 4 people
Affects Status Importance Assigned to Milestone
glibc (Debian)
Fix Released
Unknown
glibc (Ubuntu)
Fix Released
High
Unassigned
Bionic
Fix Released
Undecided
Balint Reczey

Bug Description

[Impact]

 * pthread_rwlock_trywrlock and pthread_rwlock_tryrdlock before glibc 2.30 could hang: https://sourceware.org/bugzilla/show_bug.cgi?id=23844#c14

 * We are especially able to reproduce the problem with BIND 9.16.x when --with-pthread-rwlock configure option enabled

 * But the impact is not limited to BIND 9.16, but any multithreaded application using phtread rwlocks

[Test Case]

* Fetch the source program and build it:
$ sudo apt install build-essential -y
$ wget https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1864864/+attachment/5333068/+files/bug23844.wr.c
$ gcc bug23844.wr.c -lpthread -o bug23844wr

* Run the resulting binary a few times. On affected systems, it should hang in less then 10 attempts.

$ ./bug23844rw
trylock_wr
500000

(...)

$ ./bug23844.wr
trylock_wr
<hangs>

[Regression Potential]

 * The upstream fix has been in glibc 2.30 and later
 * Debian has the fix in 2.28-8 as part of "git-updates.diff" from February 2019

Related branches

CVE References

Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

Thank you for taking the time to report this bug and helping to make Ubuntu better. It seems that your bug report is not filed about a specific source package though, rather it is just filed against Ubuntu in general. It is important that bug reports be filed about source packages so that people interested in the package can find the bugs about it. You can find some hints about determining what package your bug might be about at https://wiki.ubuntu.com/Bugs/FindRightPackage. You might also ask for help in the #ubuntu-bugs irc channel on Freenode.

To change the source package that this bug is filed about visit https://bugs.launchpad.net/ubuntu/+bug/1864864/+editstatus and add the package name in the text box next to the word Package.

[This is an automated message. I apologize if it reached you inappropriately; please just reply to this message indicating so.]

tags: added: bot-comment
Revision history for this message
Ondřej Surý (ondrej) wrote :

JFTR RHEL 8 and FC30 has already pulled the fix into their glibc, so it's really only Ubuntu and Debian affected by this.

affects: ubuntu → glibc (Ubuntu)
Revision history for this message
Ondřej Surý (ondrej) wrote :

According to upstream, the issue first appeared in 2.26, so only bionic is affected.

Revision history for this message
Ondřej Surý (ondrej) wrote :

JFTR Debian 2.28-8 has already the fix applied.

Revision history for this message
Andreas Hasenack (ahasenack) wrote :

Test case. Build with:

gcc bug23844.wr.c -lpthread -o bug23844wr

description: updated
description: updated
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

I created a ppa with the fix for bionic: https://launchpad.net/~ahasenack/+archive/ubuntu/glibc-pthread-lock-23844/

After updating to that package, the test case program no longer hangs (counted 75 runs, whereas before it would hang in at most 5).

Revision history for this message
Andreas Hasenack (ahasenack) wrote :
Changed in glibc (Ubuntu):
status: New → Triaged
importance: Undecided → High
Changed in glibc (Ubuntu Bionic):
status: New → Triaged
Changed in glibc (Ubuntu):
status: Triaged → Fix Released
Changed in glibc (Debian):
status: Unknown → Fix Released
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

@nish pointed out in the MP that I had the incorrect packaging version for an SRU. Since the correct version is lower than what I uploaded before, I created a new ppa:

https://launchpad.net/~ahasenack/+archive/ubuntu/glibc-pthread-lock-1864864

Packages are still building there, but other than the version, they are the same.

Revision history for this message
Andreas Hasenack (ahasenack) wrote :

Can someone who is affected by this bug, and able to reproduce it in a test/controlled environment, please try the glibc packages from my PPA? Note you will have to restart services after the update (or better yet, reboot if you can):

https://launchpad.net/~ahasenack/+archive/ubuntu/glibc-pthread-lock-1864864

Revision history for this message
Emmanuel Fusté (emmanuel-fuste-thalesgroup) wrote :

Yes your ppa and an affected bind package build no longer hang.

Revision history for this message
Balint Reczey (rbalint) wrote :
Changed in glibc (Ubuntu Bionic):
status: Triaged → In Progress
assignee: nobody → Balint Reczey (rbalint)
Revision history for this message
Steve Langasek (vorlon) wrote : Please test proposed package

Hello Ondřej, or anyone else affected,

Accepted glibc into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/glibc/2.27-3ubuntu1.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in glibc (Ubuntu Bionic):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-bionic
description: updated
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

Bionic verification

First, reproducing the bug with the current glibc:
ubuntu@bionic-glibc-1864864:~$ apt-cache policy libc6
libc6:
  Installed: 2.27-3ubuntu1.2
  Candidate: 2.27-3ubuntu1.2
  Version table:
 *** 2.27-3ubuntu1.2 500
        500 http://br.archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages
        500 http://br.archive.ubuntu.com/ubuntu bionic-security/main amd64 Packages
        100 /var/lib/dpkg/status

It hung immediately:
ubuntu@bionic-glibc-1864864:~$ ./bug23844wr
trylock_wr
(stuck)

Second run worked, third run got stuck again:
ubuntu@bionic-glibc-1864864:~$ ./bug23844wr
trylock_wr
500000
ubuntu@bionic-glibc-1864864:~$ ./bug23844wr
trylock_wr
(stuck)

With updated glibc:
ubuntu@bionic-glibc-1864864:~$ apt-cache policy libc6
libc6:
  Installed: 2.27-3ubuntu1.3
  Candidate: 2.27-3ubuntu1.3
  Version table:
 *** 2.27-3ubuntu1.3 500
        500 http://br.archive.ubuntu.com/ubuntu bionic-proposed/main amd64 Packages
        100 /var/lib/dpkg/status

Sample program doesn't hang anymore, after multiple tries, and no need to rebuild it:
ubuntu@bionic-glibc-1864864:~$ ./bug23844wr
trylock_wr
500000
ubuntu@bionic-glibc-1864864:~$ ./bug23844wr
trylock_wr
500000
ubuntu@bionic-glibc-1864864:~$ ./bug23844wr
trylock_wr
500000
ubuntu@bionic-glibc-1864864:~$ ./bug23844wr
trylock_wr
500000
ubuntu@bionic-glibc-1864864:~$ ./bug23844wr
trylock_wr
500000
ubuntu@bionic-glibc-1864864:~$ ./bug23844wr
trylock_wr
500000
ubuntu@bionic-glibc-1864864:~$ ./bug23844wr
trylock_wr
500000

bionic verification succeeded

tags: added: verification-done-bionic
removed: verification-needed-bionic
Revision history for this message
Ubuntu SRU Bot (ubuntu-sru-bot) wrote : Autopkgtest regression report (glibc/2.27-3ubuntu1.3)
Download full text (6.9 KiB)

All autopkgtests for the newly accepted glibc (2.27-3ubuntu1.3) for bionic have finished running.
The following regressions have been reported in tests triggered by the package:

mysql-5.7/5.7.31-0ubuntu0.18.04.1 (armhf)
libsys-utmp-perl/1.8-1 (armhf)
libscope-upper-perl/0.30-1 (armhf)
octave-miscellaneous/1.2.1-4 (armhf, arm64, s390x, amd64, i386, ppc64el)
libsocket-multicast6-perl/unknown (armhf)
octave-strings/1.2.0-3 (armhf, arm64, s390x, amd64, i386, ppc64el)
libgnatcoll/unknown (armhf)
octave-econometrics/1:1.1.1-5 (armhf, arm64, s390x, amd64, i386, ppc64el)
octave-secs2d/0.0.8-9 (armhf, arm64, s390x, amd64, i386, ppc64el)
libb-hooks-parser-perl/unknown (armhf)
octave-general/2.0.0-3 (armhf, arm64, s390x, amd64, i386, ppc64el)
libcompress-raw-bzip2-perl/2.074-1build2 (armhf)
libunicode-casefold-perl/unknown (armhf)
mod-wsgi/4.5.17-1ubuntu1 (ppc64el)
libdata-alias-perl/unknown (armhf)
libdata-clone-perl/unknown (armhf)
libsort-key-perl/unknown (armhf)
linux-raspi-5.4/5.4.0-1018.20~18.04.1 (armhf)
ann/unknown (armhf)
icecast2/unknown (i386)
python-maxminddb/1.3.0-1 (armhf)
lua-torch-sundown/unknown (armhf)
libkf5mailcommon/4:17.12.3-0ubuntu1 (arm64, i386)
apport/2.20.9-0ubuntu7.17 (amd64)
linux-hwe-5.0/5.0.0-61.65 (armhf)
ffmpeg/7:3.4.8-0ubuntu0.2 (armhf, arm64, s390x, amd64, i386, ppc64el)
glibc/2.27-3ubuntu1.3 (armhf)
nut/2.7.4-5.1ubuntu2 (amd64)
mbuffer/unknown (armhf)
linux-aws-edge/5.0.0-1019.21~18.04.1 (amd64, arm64)
octave-ocs/0.1.5-6 (armhf, arm64, s390x, amd64, i386, ppc64el)
libx11-xcb-perl/unknown (armhf)
pgbouncer/1.8.1-1build1 (amd64)
indicator-session/17.3.20+17.10.20171006-0ubuntu1 (armhf)
gcc-6/6.5.0-2ubuntu1~18.04 (armhf)
vmtouch/unknown (armhf)
libhtml-gumbo-perl/0.17-1build1 (ppc64el)
octave-sparsersb/1.0.5-3 (armhf, arm64, s390x, amd64, i386, ppc64el)
octave-mpi/1.2.0-4 (armhf, arm64, s390x, amd64, i386, ppc64el)
libalgorithm-svm-perl/0.13-2build2 (s390x)
libconvert-binary-c-perl/0.78-1build2 (amd64)
kauth/5.44.0-0ubuntu1 (i386)
libkdegames-kde4/unknown (amd64)
openssh/1:7.6p1-4ubuntu0.3 (armhf, arm64, s390x, amd64, i386, ppc64el)
keditbookmarks/17.12.3-0ubuntu1 (ppc64el)
jovie/unknown (armhf)
kdepim-runtime/4:17.12.3-0ubuntu2 (armhf)
libscalar-util-numeric-perl/0.40-1build3 (s390x)
pgpdump/unknown (armhf)
libdevice-cdio-perl/0.4.0-3 (armhf)
octave-sockets/1.2.0-3 (armhf, arm64, s390x, amd64, i386, ppc64el)
octave-gsl/2.1.0-3 (armhf, arm64, s390x, amd64, i386, ppc64el)
libdbd-odbc-perl/1.56-1build1 (armhf)
libnet-dbus-perl/1.1.0-4build2 (armhf)
linux-aws-5.3/unknown (arm64)
libalgorithm-permute-perl/0.16-1 (s390x)
xdg-desktop-portal/1.0.3-0ubuntu0.2 (i386, ppc64el)
octave-ltfat/2.2.0+dfsg-7 (s390x, amd64, i386, ppc64el)
octave-geometry/3.0.0-6 (armhf, arm64, s390x, amd64, i386, ppc64el)
octave-linear-algebra/2.2.2-4 (armhf, arm64, s390x, amd64, i386, ppc64el)
octave-nurbs/1.3.13-4 (armhf, arm64, s390x, amd64, i386, ppc64el)
devscripts/2.17.12ubuntu1.1 (armhf, arm64, s390x, amd64, i386, ppc64el)
meliae/0.4.0+bzr199-3build1 (ppc64el)
libocas/unknown (armhf)
k3d/unknown (armhf)
firefox/80.0.1+build1-0ubuntu0.18.04.1 (armhf)
libb-hooks-op-check-perl/unknown (armhf)
octave-quaternion/2.4.0-4 (armhf, arm64, s390x, amd64, i38...

Read more...

Revision history for this message
Łukasz Zemczak (sil2100) wrote : Update Released

The verification of the Stable Release Update for glibc has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package glibc - 2.27-3ubuntu1.3

---------------
glibc (2.27-3ubuntu1.3) bionic; urgency=medium

  [ Balint Reczey ]
  * debian/gbp.conf: Add initial configuration
  * debian/control.in/main: Add Vcs-* pointing to Ubuntu packaging repository
  * arm64: Enable searching shared libraries in atomics/ on LSE HW
  * Ship arm64 variant with LSE support in libc6-lse (LP: #1885012)
  * Run tests of libc6-lse on HW supporting LSE
  * debian/patches/git-updates.diff: update from upstream stable branch
    - pthread_cond_broadcast: Fix waiters-after-spinning case
    - Fix SSe2-based memmove corrupting memory (CVE-2017-18269)
    - Fix strstr() performance regression on Haswell processors
    - Support Japanese new era "令和 (Reiwa)"
    - io: Remove copy_file_range emulation
    (LP: #1851263, #1858203, #1838327, #1797335, #1756209, #1853193)
  * XFAIL stdlib/tst-getrandom (LP: #1891403)
  * debian/testsuite-xfail-debian.mk: XFAIL new tst-support_descriptors

  [ Thadeu Lima de Souza Cascardo ]
  * tests: Make preadwritev2 invalid flags tests unsupported (LP: #1770480)

  [ Andreas Hasenack ]
  * branch-pthread_rwlock_trywrlock-hang-23844.patch:
    nptl: Fix pthread_rwlock_try*lock stalls (Bug 23844) (LP: #1864864)

 -- Balint Reczey <email address hidden> Wed, 02 Sep 2020 11:18:37 +0200

Changed in glibc (Ubuntu Bionic):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.