Correct crashes in TSan on NetBSD

[krytarowski]

Summary

Fix few problems on NetBSD that caused crashes.

1. Correct handling death of a thread. Stop using the Linux solution with pthread_key_create(3). This does not work on NetBSD, because calling the thread destructor is not the latest operation on a POSIX thread entity. NetBSD's libpthread still calls at least pthread_mutex_lock and pthread_mutex_unlock. Detect _lwp_exit(2) call as it is really the latest operation called from a detaching POSIX thread.

2. Add interceptor for _lwp_exit() on NetBSD-only.

3. Disable detection of on_exit() on NetBSD. Introduce TSAN_MAYBE_INTERCEPT_ON_EXIT. It looks like this code fixes build for Darwin.

4. Correct handling atexit(3). The NetBSD specific implementation of cxa_atexit() does not preserve the 2nd argument if dso is equal to NULL. Split paths of handling intercepted cxa_atexit() and atexit(3). Add a local stack-like structure to hold the __cxa_atexit() context. atexit(3) is documented in the C standard as calling callback from the earliest to the oldest entry. This path also fixes potential ABI problem of passing an argument to a function from the atexit(3) callback mechanism.
   
   Proposal to change the behavior of __cxa_atexit() in NetBSD has been rejected.

5. Introduce new internal allocator: InternalReallocArr() that has been modeled after NetBSD's reallocarr(3) extension to libc. This function is handy to resize/free arrays.

With the above changes, TSan/NetBSD can fully bootstrap into operation.

Sponsored by <The NetBSD Foundation>

[vitalybuka]

It's not obvious to guess which of 1,2,..5 correspond to which line of the patch
Could you please split patches accordingly?

[krytarowski]

This patch will be divided into smaller chunks.

lib/sanitizer_common/sanitizer_allocator.cc

void InternalFree(void *addr, InternalAllocatorCache *cache) {
   CHECK_EQ(kBlockMagic, ((u64*)addr)[0]);
   ((u64*)addr)[0] = 0;
   RawInternalFree(addr, cache);
 }
 
 // LowLevelAllocator
 static LowLevelAllocateCallback low_level_alloc_callback;
 
+int InternalReallocArr(void *addr, uptr count, uptr size,
+                       InternalAllocatorCache *cache) {
+  void *oaddr;
+  void *naddr = 0;
+
+  internal_memcpy(&oaddr, addr, sizeof(addr));
+  if (!count || !size) {
+    InternalFree(oaddr, cache);
+    internal_memcpy(addr, &naddr, sizeof(addr));
+    return 0;
+  }
+
+  naddr = InternalRealloc(oaddr, count * size, cache);
+  if (naddr == 0) return -1;
+
+  internal_memcpy(addr, &naddr, sizeof(addr));
+  return 0;
+}
+
 void *LowLevelAllocator::Allocate(uptr size) {
   // Align allocation size.
   size = RoundUpTo(size, 8);
   if (allocated_end_ - allocated_current_ < (sptr)size) {
     uptr size_to_allocate = Max(size, GetPageSizeCached());
     allocated_current_ =
         (char*)MmapOrDie(size_to_allocate, __func__);
     allocated_end_ = allocated_current_ + size_to_allocate;

lib/sanitizer_common/sanitizer_allocator_internal.h

 
 void *InternalAlloc(uptr size, InternalAllocatorCache *cache = nullptr,
                     uptr alignment = 0);
 void *InternalRealloc(void *p, uptr size,
                       InternalAllocatorCache *cache = nullptr);
 void *InternalCalloc(uptr countr, uptr size,
                      InternalAllocatorCache *cache = nullptr);
 void InternalFree(void *p, InternalAllocatorCache *cache = nullptr);
+int InternalReallocArr(void *p, uptr count, uptr size,
+                       InternalAllocatorCache *cache = nullptr);
 InternalAllocator *internal_allocator();
 
 enum InternalAllocEnum {
   INTERNAL_ALLOC
 };
 
 } // namespace __sanitizer
 
 inline void *operator new(__sanitizer::operator_new_size_type size,
                           __sanitizer::InternalAllocEnum) {
   return __sanitizer::InternalAlloc(size);
 }
 
 #endif // SANITIZER_ALLOCATOR_INTERNAL_H

lib/tsan/rtl/tsan_interceptors.cc

static ThreadSignalContext *SigCtx(ThreadState *thr) {
   if (ctx == 0 && !thr->is_dead) {
     ctx = (ThreadSignalContext*)MmapOrDie(sizeof(*ctx), "ThreadSignalContext");
     MemoryResetRange(thr, (uptr)&SigCtx, (uptr)ctx, sizeof(*ctx));
     thr->signal_ctx = ctx;
   }
   return ctx;
 }
 
-#if !SANITIZER_MAC
+#if !SANITIZER_MAC && !SANITIZER_NETBSD
 static unsigned g_thread_finalize_key;
 #endif
 
 ScopedInterceptor::ScopedInterceptor(ThreadState *thr, const char *fname,
                                      uptr pc)
     : thr_(thr), pc_(pc), in_ignored_lib_(false), ignoring_(false) {
   Initialize(thr);
   if (!thr_->is_inited) return;

 
 // The sole reason tsan wraps atexit callbacks is to establish synchronization
 // between callback setup and callback execution.
 struct AtExitCtx {
   void (*f)();
   void *arg;
 };
 
-static void at_exit_wrapper(void *arg) {
+static struct AtExitCtx **AtExitStack;
+static int AtExitStackSize;
+
+static void at_exit_wrapper() {
+  ThreadState *thr = cur_thread();
+  uptr pc = 0;
+
+  // Pop AtExitCtx from the top of the stack of callback functions
+  AtExitCtx *ctx = AtExitStack[AtExitStackSize - 1];
+  --AtExitStackSize;
+  if (InternalReallocArr(&AtExitStack, AtExitStackSize,
+                         sizeof(struct AtExitCtx *))) {
+    Printf("InternalReallocArr error");
+    Die();
+  }
+
+  Acquire(thr, pc, (uptr)ctx);
+  ((void(*)())ctx->f)();
+  InternalFree(ctx);
+}
+
+static void cxa_at_exit_wrapper(void *arg) {
   ThreadState *thr = cur_thread();
   uptr pc = 0;
   Acquire(thr, pc, (uptr)arg);
   AtExitCtx *ctx = (AtExitCtx*)arg;
   ((void(*)(void *arg))ctx->f)(ctx->arg);
   InternalFree(ctx);
 }
 
static int setup_at_exit_wrapper(ThreadState *thr, uptr pc, void(*f)(),
       void *arg, void *dso) {
   AtExitCtx *ctx = (AtExitCtx*)InternalAlloc(sizeof(AtExitCtx));
   ctx->f = f;
   ctx->arg = arg;
   Release(thr, pc, (uptr)ctx);
   // Memory allocation in __cxa_atexit will race with free during exit,
   // because we do not see synchronization around atexit callback list.
   ThreadIgnoreBegin(thr, pc);
-  int res = REAL(__cxa_atexit)(at_exit_wrapper, ctx, dso);
+  int res;
+  if (dso == 0) {
+    // NetBSD does not preserve the 2nd argument if dso is equal to 0
+    // Store ctx in a local stack-like structure
+    res = REAL(__cxa_atexit)((void (*)(void *a))at_exit_wrapper, 0, 0);
+    // Push AtExitCtx on the top of the stack of callback functions
+    if (res == 0) {
+      ++AtExitStackSize;
+      if (InternalReallocArr(&AtExitStack, AtExitStackSize,
+                             sizeof(struct AtExitCtx *))) {
+        Printf("InternalReallocArr error");
+        Die();
+      }
+      AtExitStack[AtExitStackSize - 1] = ctx;
+    }
+  } else {
+    res = REAL(__cxa_atexit)(cxa_at_exit_wrapper, ctx, dso);
+  }
   ThreadIgnoreEnd(thr, pc);
   return res;
 }
 
-#if !SANITIZER_MAC
+#if !SANITIZER_MAC && !SANITIZER_NETBSD
 static void on_exit_wrapper(int status, void *arg) {
   ThreadState *thr = cur_thread();
   uptr pc = 0;
   Acquire(thr, pc, (uptr)arg);
   AtExitCtx *ctx = (AtExitCtx*)arg;
   ((void(*)(int status, void *arg))ctx->f)(status, ctx->arg);
   InternalFree(ctx);
 }
 
 TSAN_INTERCEPTOR(int, on_exit, void(*f)(int, void*), void *arg) {
   if (cur_thread()->in_symbolizer)
     return 0;
   SCOPED_TSAN_INTERCEPTOR(on_exit, f, arg);
   AtExitCtx *ctx = (AtExitCtx*)InternalAlloc(sizeof(AtExitCtx));
   ctx->f = (void(*)())f;
   ctx->arg = arg;
   Release(thr, pc, (uptr)ctx);
   // Memory allocation in __cxa_atexit will race with free during exit,
   // because we do not see synchronization around atexit callback list.
   ThreadIgnoreBegin(thr, pc);
   int res = REAL(on_exit)(on_exit_wrapper, ctx);
   ThreadIgnoreEnd(thr, pc);
   return res;
 }
+#define TSAN_MAYBE_INTERCEPT_ON_EXIT TSAN_INTERCEPT(on_exit)
+#else
+#define TSAN_MAYBE_INTERCEPT_ON_EXIT
 #endif
 
 // Cleanup old bufs.
 static void JmpBufGarbageCollect(ThreadState *thr, uptr sp) {
   for (uptr i = 0; i < thr->jmp_bufs.Size(); i++) {
     JmpBuf *buf = &thr->jmp_bufs[i];
     if (buf->sp <= sp) {
       uptr sz = thr->jmp_bufs.Size();
if (sctx) {
     thr->signal_ctx = 0;
     UnmapOrDie(sctx, sizeof(*sctx));
   }
   DTLS_Destroy();
   cur_thread_finalize();
 }
 }  // namespace __tsan
 
-#if !SANITIZER_MAC
+#if !SANITIZER_MAC && !SANITIZER_NETBSD
 static void thread_finalize(void *v) {
   uptr iter = (uptr)v;
   if (iter > 1) {
     if (pthread_setspecific(g_thread_finalize_key, (void*)(iter - 1))) {
       Printf("ThreadSanitizer: failed to set thread key\n");
       Die();
     }
     return;
extern "C" void *__tsan_thread_start_func(void *arg) {
   ThreadParam *p = (ThreadParam*)arg;
   void* (*callback)(void *arg) = p->callback;
   void *param = p->param;
   int tid = 0;
   {
     ThreadState *thr = cur_thread();
     // Thread-local state is not initialized yet.
     ScopedIgnoreInterceptors ignore;
-#if !SANITIZER_MAC
+#if !SANITIZER_MAC && !SANITIZER_NETBSD
     ThreadIgnoreBegin(thr, 0);
     if (pthread_setspecific(g_thread_finalize_key,
                             (void *)GetPthreadDestructorIterations())) {
       Printf("ThreadSanitizer: failed to set thread key\n");
       Die();
     }
     ThreadIgnoreEnd(thr, 0);
 #endif
TSAN_INTERCEPTOR(void *, __tls_get_addr, void *arg) {
   if (!dtv)
     return res;
   // New DTLS block has been allocated.
   MemoryResetRange(thr, 0, dtv->beg, dtv->size);
   return res;
 }
 #endif
 
+#if SANITIZER_NETBSD
+TSAN_INTERCEPTOR(void, _lwp_exit) {
+  SCOPED_TSAN_INTERCEPTOR(_lwp_exit);
+  REAL(_lwp_exit)();
+  DestroyThreadState();
+}
+#define TSAN_MAYBE_INTERCEPT__LWP_EXIT TSAN_INTERCEPT(_lwp_exit)
+#else
+#define TSAN_MAYBE_INTERCEPT__LWP_EXIT
+#endif
+
 namespace __tsan {
 
 static void finalize(void *arg) {
   ThreadState *thr = cur_thread();
   int status = Finalize(thr);
   // Make sure the output is not lost.
   FlushStreams();
   if (status)
#endif
   TSAN_INTERCEPT(gettimeofday);
   TSAN_INTERCEPT(getaddrinfo);
 
   TSAN_INTERCEPT(fork);
   TSAN_INTERCEPT(vfork);
 #if !SANITIZER_ANDROID
   TSAN_INTERCEPT(dl_iterate_phdr);
 #endif
-  TSAN_INTERCEPT(on_exit);
+  TSAN_MAYBE_INTERCEPT_ON_EXIT;
   TSAN_INTERCEPT(__cxa_atexit);
   TSAN_INTERCEPT(_exit);
 
 #ifdef NEED_TLS_GET_ADDR
   TSAN_INTERCEPT(__tls_get_addr);
 #endif
 
+  TSAN_MAYBE_INTERCEPT__LWP_EXIT;
+
 #if !SANITIZER_MAC && !SANITIZER_ANDROID
   // Need to setup it, because interceptors check that the function is resolved.
   // But atexit is emitted directly into the module, so can't be resolved.
   REAL(atexit) = (int(*)(void(*)()))unreachable;
 #endif
 
   if (REAL(__cxa_atexit)(&finalize, 0, 0)) {
     Printf("ThreadSanitizer: failed to setup atexit callback\n");
     Die();
   }
 
-#if !SANITIZER_MAC
+#if !SANITIZER_MAC && !SANITIZER_NETBSD
   if (pthread_key_create(&g_thread_finalize_key, &thread_finalize)) {
     Printf("ThreadSanitizer: failed to create thread key\n");
     Die();
   }
 #endif
 
   FdInit();
 }