There is a data race in _dl_profile_fixup where multiple threads may enter from the same PLT entry, and update the same reloc_result index entry. This is similar to the data dependency issues from bug 23690, but there we only look to solve the issue for threads that find the guard variable indicating the structure is initialized only to see incomplete writes to the structure and crash. The fix is for _dl_profile_fixup to be rewritten such that the threads work on a local copy of a struct reloc_result and then use a RMW sequence to place it into the final array, and thus we avoid the data races.
This issue is only relevant when the PLT entry is a multi-word entry and therefore needs multiple writes to complete. I think that IA64 and HPPA (32-bit) are impacted by this issue because of the function descriptor in the PLT. The power code also likely suffers from this, but in binutils the PLT update sequence is designed to be "thread safe" using architecture-related interlocks.
(In reply to Carlos O'Donell from comment #1) > This issue is only relevant when the PLT entry is a multi-word entry and > therefore needs multiple writes to complete. > > I think that IA64 and HPPA (32-bit) are impacted by this issue because of > the function descriptor in the PLT. > > The power code also likely suffers from this, but in binutils the PLT update > sequence is designed to be "thread safe" using architecture-related > interlocks. What I wrote here applies both to the traditional PLT fixup in the dynamic loader *and* the fixup of the cached entries while profiling. This particular bug is about only the fixup of the cached entries which are updated when profiling. In this case glibc is entirely responsible for the update.
Here is a race condition in dlprofile_fixup with reloc_result update from multiple threads. The problem is that dlprofile_fixup can be executed from different threads concurrently and the code which handles the result of the relocation is not protected against concurrent writes, which leads to data races on the reloc_result variable. https://iheartcbdoil.com/cbd-benefits/how-cbd-can-be-helpful-for-heart-diseases/