Bug 95005 - socket.c - data race on m_nLastError member (Comment 6)
Summary: socket.c - data race on m_nLastError member (Comment 6)
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: Other Linux (All)
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: Dev-related
  Show dependency treegraph
 
Reported: 2015-10-13 10:20 UTC by straub
Modified: 2023-07-09 13:29 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description straub 2015-10-13 10:20:54 UTC
The m_nLastError member is written by reader and writer thread -> helgrind reports a data races. I'd suggest to use two separate members, one for read errors, one for write errors.
Comment 1 Julien Nabet 2015-10-13 13:07:38 UTC
4.1 branch is EOL, as 4.2, 4.3 and soon 4.4 branch.
Please test with a recent LO version (last one is 5.0.2).
Comment 2 straub 2015-10-14 07:37:16 UTC
Issue also affects 5.0.3.1 source code.
Comment 3 Julien Nabet 2015-10-14 18:58:22 UTC
Thank you for your feedback but could you be more specific? Which Linux distrib do you use? Which test did you do? (except you used Helgrind, there's nothing)
Could http://cgit.freedesktop.org/libreoffice/core/commit/?id=309aa845a8e413519d634680aff112a3567e2e61 help here?
Comment 4 straub 2016-01-12 09:16:59 UTC
The same socket object is used by the reader and writer threads that handle UNO IPC. The reader thread processes incoming IPC requests and uses socket read operations, the writer thread sends outgoing IPCs and replies and uses socket write operations. But both socket read and write operations access the same m_nLastError member in the socket. Since reader and writer thread write the same member, helgrind reports data races on m_nLastError.
Comment 5 Julien Nabet 2016-01-12 09:26:00 UTC
Thank you for your feedback. Since I've got no more questions, I put it back to UNCONFIRMED.

Stephan: thought you might be interested in this one since it concerns UNO part.
Comment 6 Stephan Bergmann 2016-01-12 10:12:42 UTC
(In reply to straub from comment #0)
> The m_nLastError member is written by reader and writer thread -> helgrind
> reports a data races. I'd suggest to use two separate members, one for read
> errors, one for write errors.

I assume you mean the oslSocketImpl::m_nLastError (sal/osl/unx/sockimpl.hxx) member, as used in the sal/osl/unx/socket.cxx implementation of the osl/socket.h functionality, and the reader and writer threads of the binary URP implementation, binaryurp/source/{reader,writer}.hxx.

Splitting oslSocketImpl::m_nLastError would not be trivial, as there is only a single osl_getLastSocketError function in the stable URE interface.

The reader/writer threads access the shared socket through a css::connection::XConnection UNO object, implemented in io/source/connector/ctr_socket.cxx.  The general requirement for UNO objects is to be thread safe (for better or worse), so one could naively argue that that implementation should take care of using its m_socket member in a way that ensures that concurrent use of m_nLastError in the underlying socket implementation cannot happen.  However, that would not work, as osl_send/receiveSocket are blocking.

It looks like the osl/socket.h abstraction is broken.
Comment 7 QA Administrators 2017-03-06 14:04:24 UTC Comment hidden (obsolete)
Comment 8 straub 2018-10-17 06:34:04 UTC
Still present in LibreOffice 6 codestream.
Comment 9 QA Administrators 2019-10-18 02:40:23 UTC Comment hidden (obsolete)
Comment 10 straub 2019-10-21 06:37:49 UTC
I verified that this bug is present in the OOo source code and has been inherited from there.
Comment 11 QA Administrators 2021-10-21 03:35:35 UTC Comment hidden (obsolete)
Comment 12 Marc-Oliver Straub 2021-10-28 07:51:59 UTC
Still present in master