Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 3 Feb 2021 15:21:06 -0500
From: Dominic Chen <>
To: Rich Felker <>,
Subject: Re: Incorrect thread TID caching

On 2/3/2021 2:16 AM, Florian Weimer wrote:
> If you use the clone system call wrapper in threading (not fork/vfork)
> mode, you cannot call any libc functions afterwards, including the
> syscall function.  Instead, you have to issue direct system calls.
On 2/3/2021 2:21 PM, Rich Felker wrote:
> Unfortunately it's really underdocumented and underexplored what a
> child created with clone() can do. There are definitely limitations --
> for example any usage with CLONE_VM or CLONE_THREAD is restricted not
> to call into libc at all, and might not even be safe whatsoever.
> However basic usage comparable in semantics to _Fork is probably
> supposed to work at least as well as _Fork -- in particular calling
> AS-safe libc functions should work.

I wasn't aware of this behavior, and didn't see any documentation about 
this for the glibc clone() wrapper either. This seems to be a big 
footgun, and after looking through the history for this code in Chrome, 
it looks like they had a similar issue with glibc too.

> BTW does Chrom{e,ium} itself do something with raw clone? If so this
> could be a source of some of the bugs users hit, and it would be great
> to get a clearer picture on what's happening.

The code in question is a unittest for the sandbox, which manually calls 
clone with CLONE_NEWPID to fork a child in a PID namespace, then 
installs a signal handler and checks that it receives SIGTERM correctly:;l=194 
. But under musl, raise() uses the cached TID value, so the test 
eventually times out.

I missed that the NamespaceSandbox::ForkInNewPidNamespace() function 
does manually update the cached TID for glibc after calling the 
ForkWithFlags wrapper, so I can just do the same for musl too.

Separately, it looks like glibc used to have a PID cache too, but was 
removed after a discussion that you were both involved with:



Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.