From owner-freebsd-bugs@FreeBSD.ORG  Mon Aug 16 00:30:25 2004
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B416A16A4CF
	for <freebsd-bugs@hub.freebsd.org>;
	Mon, 16 Aug 2004 00:30:25 +0000 (GMT)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 9625A43D39
	for <freebsd-bugs@hub.freebsd.org>;
	Mon, 16 Aug 2004 00:30:25 +0000 (GMT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.12.11/8.12.11) with ESMTP id i7G0UPAT037478
	for <freebsd-bugs@freefall.freebsd.org>; Mon, 16 Aug 2004 00:30:25 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.12.11/8.12.11/Submit) id i7G0UPg4037476;
	Mon, 16 Aug 2004 00:30:25 GMT
	(envelope-from gnats)
Resent-Date: Mon, 16 Aug 2004 00:30:25 GMT
Resent-Message-Id: <200408160030.i7G0UPg4037476@freefall.freebsd.org>
Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer)
Resent-To: freebsd-bugs@FreeBSD.org
Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org,
	Jake Hamby <jhamby@anobject.com>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 99F0C16A4CF
	for <FreeBSD-gnats-submit@freebsd.org>;
	Mon, 16 Aug 2004 00:21:29 +0000 (GMT)
Received: from bronco.gopix.net (gopix.net [38.118.153.46])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 4E6E343D45
	for <FreeBSD-gnats-submit@freebsd.org>;
	Mon, 16 Aug 2004 00:21:29 +0000 (GMT)
	(envelope-from jhamby@anobject.com)
Received: from localhost.my.domain
	(ca-stmnca-cuda2-blade8b-87.stmnca.adelphia.net [68.65.226.87])
	by bronco.gopix.net (8.12.11/8.12.11) with ESMTP id i7G0LRYB008778
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
	for <FreeBSD-gnats-submit@freebsd.org>;
	Sun, 15 Aug 2004 17:21:28 -0700
Received: (from jhamby@localhost)
	by localhost.my.domain (8.13.1/8.13.1/Submit) id i7G0LRYC003133;
	Sun, 15 Aug 2004 17:21:27 -0700 (PDT)
	(envelope-from jhamby)
Message-Id: <200408160021.i7G0LRYC003133@localhost.my.domain>
Date: Sun, 15 Aug 2004 17:21:27 -0700 (PDT)
From: Jake Hamby <jhamby@anobject.com>
To: FreeBSD-gnats-submit@FreeBSD.org
X-Send-Pr-Version: 3.113
Subject: kern/70502: error in new __thread local storage support
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: Jake Hamby <jhamby@anobject.com>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 16 Aug 2004 00:30:25 -0000


>Number:         70502
>Category:       kern
>Synopsis:       error in new __thread local storage support
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Aug 16 00:30:24 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Jake Hamby
>Release:        FreeBSD 5.2-CURRENT i386
>Organization:
Software Factory x
>Environment:
System: FreeBSD fuji 5.2-CURRENT FreeBSD 5.2-CURRENT #2: Sat Aug 14 19:00:56 PDT 2004 root@fuji:/usr/home/work/sys/FUJI i386
>Description:

The new __thread based TLS code doesn't seem to work beyond a particular size.

>How-To-Repeat:

See the attached test program.  On my machine, it works for NUM_KEYS=6, but
with NUM_KEYS=10 I see data corruption in the TLS area, and with NUM_KEYS=64,
it crashes, so the TLS region is definitely overwriting something important.

$ gcc -O2 -o tls_nptl_test tls_nptl_test.c -lpthread
$ ./tls_nptl_test

Fatal error '_pq_remove: Not in priority queue' at line 144 in file /usr/src/lib/libpthread/thread/thr_priority_queue.c (errno = 0)
Segmentation fault (core dumped)

>Fix:

I don't know the code well enough to suggest a fix.

--- tls_nptl_test.c begins here ---

/*
 * Test of pthreads / TLS storage.
 */

#define _REENTRANT
#include <stdio.h>
#include <pthread.h>
#include <time.h>
#include <dlfcn.h>

#define NUM_THREADS 64
#define NUM_KEYS 64
static __thread int TLS_keys[NUM_KEYS];
static pthread_t threads[NUM_THREADS];

static void*
start_routine(void *arg)
{
	int thread_num = (int)arg;
	int i, err;
	for(i=0; i<500; i++)
	{
		if (i==17)
		{
		/*	printf("Thread %d: Number 17:  break for debugger\n",
				thread_num); */
		}
		int j;
		for(j=0; j<NUM_KEYS; j++)
		{
			/* verify old key value (except first time through loop) */
			int val = TLS_keys[j];
			if (val != i && (i != 0))
			{
				printf("Thread %d: expected %d for key %d, found %d\n",
					thread_num, i, j, val);
				return (void*)1;
			}
			/* set new key value */
			TLS_keys[j] = i+1;
		}
		/* sleep from 0.1 to 1 sec. */
		struct timespec slptime = {0, 100000000 + random()%900000000};
		/*printf("Thread %d: foo sleep %d\n", thread_num, slptime.tv_nsec);*/
		nanosleep(&slptime, 0);
	}
	return 0;
}

int
main(int argc, char** argv)
{
	int i;
	const char* dlerr = dlerror();
	if (dlerr)
	{
		printf("dlerror: %s\n", dlerr);
		return 1;
	}
	for(i=0; i<NUM_THREADS; i++)
	{
		int err = pthread_create(&threads[i], NULL, start_routine,
					 (void*)i);
		if (err)
		{
			printf("pthread_create error %d for thread %d\n", err, i);
			return 1;
		}
	}
	for(i=0; i<NUM_THREADS; i++)
	{
		void* retval;
		int err = pthread_join(threads[i], &retval);
		if (err)
		{
			printf("pthread_join error %d for thread %d\n", err, i);
			return 1;
		}
	}
	return 0;
}
--- tls_nptl_test.c ends here ---


>Release-Note:
>Audit-Trail:
>Unformatted: