Re: [PATCH] wcsmbs: Fix data race in __wcsmbs_clone_conv [BZ #24584]

[Andreas Schwab <schwab at suse dot de>]

On Mai 20 2019, Florian Weimer <fweimer@redhat.com> wrote:

> diff --git a/iconv/gconv_int.h b/iconv/gconv_int.h
> index ea41d6feaa..9510102c07 100644
> --- a/iconv/gconv_int.h
> +++ b/iconv/gconv_int.h
> @@ -45,7 +45,8 @@ struct __gconv_loaded_object
>    const char *name;
>  
>    /* Reference counter for the db functionality.  If no conversion is
> -     needed we unload the db library.  */
> +     needed we unload the db library.  __gconv_lock is used to
> +     synchronize updates to this field.  */
>    int counter;

That's struct __gconv_loaded_object.

> @@ -223,12 +224,24 @@ __wcsmbs_clone_conv (struct gconv_fcts *copy)
>    /* Copy the data.  */
>    *copy = *orig;
>  
> -  /* Now increment the usage counters.
> -     Note: This assumes copy->*_nsteps == 1.  */
> +  /* Now increment the usage counters.  Note: This assumes
> +     copy->*_nsteps == 1.  The current locale holds a reference, so it
> +     is still there after acquiring the lock.  */
> +
> +  __libc_lock_lock (__gconv_lock);
> +
> +  bool overflow = false;
>    if (copy->towc->__shlib_handle != NULL)
> -    ++copy->towc->__counter;
> +    overflow |= __builtin_add_overflow (copy->towc->__counter, 1,
> +					&copy->towc->__counter);

That's struct __gconv_step.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."