stdlib: Make getenv thread-safe in more cases
Async-signal-safety is preserved, too. In fact, getenv is fully
reentrant and can be called from the malloc call in setenv
(if a replacement malloc uses getenv during its initialization).
This is relatively easy to implement because even before this change,
setenv, unsetenv, clearenv, putenv do not deallocate the environment
strings themselves as they are removed from the environment.
The main changes are:
* Use release stores for environment array updates, following
the usual pattern for safely publishing immutable data
(in this case, the environment strings).
* Do not deallocate the environment array. Instead, keep older
versions around and adopt an exponential resizing policy. This
results in an amortized constant space leak per active environment
variable, but there already is such a leak for the variable itself
(and that is even length-dependent, and includes no-longer used
values).
* Add a seqlock-like mechanism to retry getenv if a concurrent
unsetenv is observed. Without that, it is possible that
getenv returns NULL for a variable that is never unset. This
is visible on some AArch64 implementations with the newly
added stdlib/tst-getenv-unsetenv test case. The mechanism
is not a pure seqlock because it tolerates one write from
unsetenv. This avoids the need for a second copy of the
environ array that getenv can read from a signal handler
that happens to interrupt an unsetenv call.
No manual updates are included with this patch because environ
usage with execve, posix_spawn, system is still not thread-safe
relative unsetenv. The new process may end up with an environment
that misses entries that were never unset. This is the same issue
described above for getenv.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
2024-11-21 20:10:52 +00:00
|
|
|
/* Test getenv with concurrent setenv.
|
2025-01-01 18:14:45 +00:00
|
|
|
Copyright (C) 2024-2025 Free Software Foundation, Inc.
|
stdlib: Make getenv thread-safe in more cases
Async-signal-safety is preserved, too. In fact, getenv is fully
reentrant and can be called from the malloc call in setenv
(if a replacement malloc uses getenv during its initialization).
This is relatively easy to implement because even before this change,
setenv, unsetenv, clearenv, putenv do not deallocate the environment
strings themselves as they are removed from the environment.
The main changes are:
* Use release stores for environment array updates, following
the usual pattern for safely publishing immutable data
(in this case, the environment strings).
* Do not deallocate the environment array. Instead, keep older
versions around and adopt an exponential resizing policy. This
results in an amortized constant space leak per active environment
variable, but there already is such a leak for the variable itself
(and that is even length-dependent, and includes no-longer used
values).
* Add a seqlock-like mechanism to retry getenv if a concurrent
unsetenv is observed. Without that, it is possible that
getenv returns NULL for a variable that is never unset. This
is visible on some AArch64 implementations with the newly
added stdlib/tst-getenv-unsetenv test case. The mechanism
is not a pure seqlock because it tolerates one write from
unsetenv. This avoids the need for a second copy of the
environ array that getenv can read from a signal handler
that happens to interrupt an unsetenv call.
No manual updates are included with this patch because environ
usage with execve, posix_spawn, system is still not thread-safe
relative unsetenv. The new process may end up with an environment
that misses entries that were never unset. This is the same issue
described above for getenv.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
2024-11-21 20:10:52 +00:00
|
|
|
This file is part of the GNU C Library.
|
|
|
|
|
|
|
|
|
|
The GNU C Library is free software; you can redistribute it and/or
|
|
|
|
|
modify it under the terms of the GNU Lesser General Public
|
|
|
|
|
License as published by the Free Software Foundation; either
|
|
|
|
|
version 2.1 of the License, or (at your option) any later version.
|
|
|
|
|
|
|
|
|
|
The GNU C Library is distributed in the hope that it will be useful,
|
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
|
Lesser General Public License for more details.
|
|
|
|
|
|
|
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
|
|
|
License along with the GNU C Library; if not, see
|
|
|
|
|
<https://www.gnu.org/licenses/>. */
|
|
|
|
|
|
|
|
|
|
#include <stdbool.h>
|
|
|
|
|
#include <stdio.h>
|
|
|
|
|
#include <stdlib.h>
|
|
|
|
|
#include <support/check.h>
|
|
|
|
|
#include <support/xthread.h>
|
|
|
|
|
|
|
|
|
|
/* Set to false by the main thread after doing all the setenv
|
|
|
|
|
calls. */
|
|
|
|
|
static bool running = true;
|
|
|
|
|
|
|
|
|
|
/* Used to synchronize the start of the getenv thread. */
|
|
|
|
|
static pthread_barrier_t barrier;
|
|
|
|
|
|
|
|
|
|
/* Invoke getenv for a nonexisting environment variable in a loop.
|
|
|
|
|
This checks that concurrent setenv does not invalidate the
|
|
|
|
|
environment array while getenv reads it. */
|
|
|
|
|
static void *
|
|
|
|
|
getenv_thread (void *ignored)
|
|
|
|
|
{
|
|
|
|
|
xpthread_barrier_wait (&barrier);
|
|
|
|
|
while (__atomic_load_n (&running, __ATOMIC_RELAXED))
|
|
|
|
|
TEST_VERIFY (getenv ("unset_variable") == NULL);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int
|
|
|
|
|
do_test (void)
|
|
|
|
|
{
|
|
|
|
|
xpthread_barrier_init (&barrier, NULL, 2);
|
|
|
|
|
pthread_t thr = xpthread_create (NULL, getenv_thread, NULL);
|
|
|
|
|
xpthread_barrier_wait (&barrier);
|
|
|
|
|
for (int i = 0; i < 1000; ++i)
|
|
|
|
|
{
|
|
|
|
|
char buf[30];
|
|
|
|
|
snprintf (buf, sizeof (buf), "V%d", i);
|
|
|
|
|
TEST_COMPARE (setenv (buf, buf + 1, 1), 0);
|
|
|
|
|
}
|
|
|
|
|
__atomic_store_n (&running, false, __ATOMIC_RELAXED);
|
|
|
|
|
xpthread_join (thr);
|
|
|
|
|
xpthread_barrier_destroy (&barrier);
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#include <support/test-driver.c>
|
