Bug 46446

Summary: fflush(0) not thread safe
Product: [Retired] Red Hat Linux Reporter: André Johansen <andrejoh>
Component: glibcAssignee: Jakub Jelinek <jakub>
Status: CLOSED CURRENTRELEASE QA Contact: Aaron Brown <abrown>
Severity: high Docs Contact:
Priority: medium    
Version: 7.1CC: fweimer, yinglu
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2003-11-23 20:42:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Threaded fflush(0) example code none

Description André Johansen 2001-06-28 18:09:34 UTC 
Calling fflush(0) in a multi-threaded application can crash it.
I will attach a program that can reproduce this problem; I've tried it
on both Red Hat Linux v6.2 and v7.1, both fully updated,
both dual Pentium 3 machines.

By inspecting the GNU libc code, it seems no locking is done in the
_IO_flush_all() call, so I guess closing a file during fflush(0) can
break the list-iteration done in that function.

The attached example crashes much faster on the v7.1 machine (which is
also faster); the v7.1 is updated vanilla, the v6.2 one uses GCC v2.95.3
as compiler.  On the v7.1 machine, it crashes in a few seconds, on the 6.2
machine, it can take a few minutes before it crashes.

All crashes are SIGSEGV.

I know ISO C does not say anything about thread safety in the IO
library, but GNU libio/libc seems to be implemented with thread safety
in mind.
Comment 1 André Johansen 2001-06-28 18:14:33 UTC 
Created attachment 22086 [details]
Threaded fflush(0) example code
Comment 2 Jakub Jelinek 2001-07-25 12:37:55 UTC 
Should be fixed in glibc-2.2.3-17.
At least I run the test for more than an hour without any problems.
Comment 3 André Johansen 2003-11-23 20:40:46 UTC 
Jakub, I think this bug can be closed -- it has worked correctly for 
ages now ;-)