The testcase tst-cancel[x]17 ends sometimes with a segmentation fault.
This happens in one of 10000 cases. Then the real testcase has already
exited with success and returned from do_test(). The segmentation fault
occurs after returning from main in _dl_fini().
In those cases, the aio_read(&a) was not canceled because the read
request was already in progress. In the meanwhile aio_write(ap) wrote
something to the pipe and the read request is able to read the
requested byte.
The read request hasn't finished before returning from do_test().
After it finishes, it writes the return value and error code from the
read syscall to the struct aiocb a, which lies on the stack of do_test.
The stack of the subsequent function call of _dl_fini or _dl_sort_fini,
which is inlined in _dl_fini is corrupted.
In case of S390, it reads a zero and decrements it by 1:
unsigned int k = nmaps - 1;
struct link_map **runp = maps[k]->l_initfini;
The load from unmapped memory leads to the segmentation fault.
The stack corruption also happens on other architectures.
I saw them e.g. on x86 and ppc, too.
This patch adds an aio_suspend call to ensure, that the read request
is finished before returning from do_test().
ChangeLog:
* nptl/tst-cancel17.c (do_test): Wait for finishing aio_read(&a).
2003-07-24 Jakub Jelinek <jakub@redhat.com>
* sysdeps/pthread/aio_cancel.c (aio_cancel): Return AIO_ALLDONE
if aiocbp != NULL and has already completed. Return -1/EINVAL if
aiocbp->aio_fildes does not match fildes.
* sysdeps/pthread/aio_misc.h: Mark __aio_requests_mutex,
__aio_enqueue_request, __aio_find_req, __aio_find_req_fd,
__aio_free_request, __aio_notify, and __aio_sigqueue as hidden.
* sysdeps/pthread/aio_suspend.c (aio_suspend): Set errno to the result
of pthread_cond_wait if there was an error. Use pthread_cleanup_*
instead of __lbic_cleanup_region_*.
* sysdeps/unix/clock_nanosleep.c (clock_nanosleep): nanosleep
takes care of enabling cancellation.
* sysdeps/pthread/aio_suspend.c (aio_suspend): Make aio_suspend
cancelable. It's not correct to disable cancellation. Instead of
a cleanup handler.
