[tsan] Error message and hang involving signals

[tavianator]

The following test program:

#include <errno.h>
#include <signal.h>
#include <stdatomic.h>
#include <sys/wait.h>
#include <unistd.h>

static atomic_int n = 0;

static void handler(int sig, siginfo_t *info, void *context) {
        int x = atomic_load_explicit(&n, memory_order_relaxed);
        while (!atomic_compare_exchange_weak_explicit(&n, &x, x + 1,
            memory_order_acquire, memory_order_relaxed)) {
        }
}

int main(void) {
        struct sigaction action = {
                .sa_sigaction = handler,
                .sa_flags = SA_RESTART | SA_SIGINFO,
        };
        sigemptyset(&action.sa_mask);
        sigaction(SIGPIPE, &action, NULL);

        pid_t pid = fork();

        if (pid > 0) {
                usleep(1000);
                kill(pid, SIGPIPE);
                waitpid(pid, NULL, 0);
        } else if (pid == 0) {
                while (atomic_load(&n) < 1) {
                        usleep(1);
                }
        }

        return 0;
}

Reliably prints this message and hangs:

$ clang -Wall -fsanitize=thread foo.c -o foo
$ ./foo
ThreadSanitizer: CHECK failed: tsan_interceptors_posix.cpp:2107 "((thr->slot)) != (0)" (0x0, 0x0) (tid=620758)
^C
$ clang --version
clang version 20.1.6
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin

[tavianator]

Ah okay, the CHECK failed seems to come from kill() interrupting the fork() call which hasn't yet completed in the child. If I make this change:

--- a/foo.c       2025-06-13 14:54:55.554720431 -0400
+++ b/foo.c       2025-06-13 14:54:48.474764325 -0400
@@ -2,6 +2,7 @@
 #include <signal.h>
 #include <stdatomic.h>
 #include <sys/wait.h>
+#include <time.h>
 #include <unistd.h>
 
 static atomic_int n = 0;
@@ -23,12 +24,12 @@
        pid_t pid = fork();
 
        if (pid > 0) {
-               usleep(1000);
+               usleep(10000);
                kill(pid, SIGPIPE);
                waitpid(pid, NULL, 0);
        } else if (pid == 0) {
                while (atomic_load(&n) < 1) {
-                       usleep(1);
+                       nanosleep(&(struct timespec){ .tv_nsec = 1 }, NULL);
                }
        }
 

Then the message goes away, but the hang remains. The backtrace looks like

0x00005654f7829cfe in __sanitizer::FutexWait(__sanitizer::atomic_uint32_t*, unsigned int) ()
(gdb) bt
#0  0x00005654f7829cfe in __sanitizer::FutexWait(__sanitizer::atomic_uint32_t*, unsigned int) ()
#1  0x00005654f782b57d in __sanitizer::Semaphore::Wait() ()
#2  0x00005654f78dab85 in __tsan::SlotLock(__tsan::ThreadState*) ()
#3  0x00005654f78ceae2 in __tsan_atomic32_compare_exchange_val ()
#4  0x00005654f78fa094 in handler ()
#5  0x00005654f7864d0e in __tsan::CallUserSignalHandler(__tsan::ThreadState*, bool, bool, int, __sanitizer::__sanitizer_siginfo*, void*) ()
#6  0x00005654f78651e7 in sighandler(int, __sanitizer::__sanitizer_siginfo*, void*) ()
#7  <signal handler called>
#8  0x00005654f78e9862 in __tsan::AfterSleep(__tsan::ThreadState*, unsigned long) ()
#9  0x00005654f786726c in __interceptor_nanosleep ()
#10 0x00005654f78f9ff0 in main ()

[tavianator]

Now with -shared-libsan for debug symbols:

#0  0x00007f60d564717e in __sanitizer::FutexWait (p=p@entry=0x7f60d6ab3788 <__tsan::ctx_placeholder+10486408>, cmp=cmp@entry=0)
    at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/sanitizer_common/sanitizer_linux.cpp:810
#1  0x00007f60d56489fd in __sanitizer::Semaphore::Wait (this=this@entry=0x7f60d6ab3788 <__tsan::ctx_placeholder+10486408>)
    at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/sanitizer_common/sanitizer_mutex.cpp:35
#2  0x00007f60d56fa895 in __sanitizer::Mutex::Lock (this=<optimized out>) at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/tsan/rtl/../../sanitizer_common/sanitizer_mutex.h:196
#3  __tsan::SlotLock (thr=thr@entry=0x7f60d6b65780) at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/tsan/rtl/tsan_rtl.cpp:367
#4  0x00007f60d56ee732 in __tsan::SlotLocker::SlotLocker (this=<synthetic pointer>, thr=0x7f60d6b65780, recursive=false)
    at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/tsan/rtl/tsan_rtl.h:641
#5  (anonymous namespace)::OpCAS::Atomic<unsigned int> (thr=0x7f60d6b65780, pc=94492593968052, mo=__tsan::mo_acquire, fmo=__tsan::mo_relaxed, a=0x55f0c57f8084 <n>, c=<synthetic pointer>, 
    v=1) at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/tsan/rtl/tsan_interface_atomic.cpp:452
#6  (anonymous namespace)::OpCAS::Atomic<unsigned int> (thr=0x7f60d6b65780, pc=94492593968052, mo=__tsan::mo_acquire, fmo=__tsan::mo_relaxed, a=0x55f0c57f8084 <n>, c=0, v=1)
    at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/tsan/rtl/tsan_interface_atomic.cpp:480
#7  AtomicImpl<(anonymous namespace)::OpCAS, __tsan::morder, unsigned int volatile*, unsigned int, unsigned int> (mo=__tsan::mo_acquire)
    at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/tsan/rtl/tsan_interface_atomic.cpp:529
#8  __tsan_atomic32_compare_exchange_val (a=0x55f0c57f8084 <n>, c=0, v=1, mo=2, fmo=0) at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/tsan/rtl/tsan_interface_atomic.cpp:855
#9  0x000055f0c57f53b4 in handler ()
#10 0x00007f60d5682c1f in __tsan::CallUserSignalHandler (thr=0x7f60d6b65780, sync=true, acquire=<optimized out>, sig=13, info=0x7ffe3633ceb0, uctx=0x7ffe3633cd80)
    at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/tsan/rtl/tsan_interceptors_posix.cpp:2145
#11 0x00007f60d56830f7 in sighandler (sig=<optimized out>, info=0x7ffe3633ceb0, ctx=<optimized out>)
    at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/tsan/rtl/tsan_interceptors_posix.cpp:2233
#12 <signal handler called>
#13 __tsan::AfterSleep (thr=0x7f60d6b65780, pc=pc@entry=140053873971318) at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/tsan/rtl/tsan_rtl_mutex.cpp:523
#14 0x00007f60d568514c in ___interceptor_nanosleep (req=<optimized out>, rem=<optimized out>)
    at /usr/src/debug/compiler-rt/compiler-rt-20.1.6.src/lib/tsan/rtl/tsan_interceptors_posix.cpp:408
#15 0x000055f0c57f5310 in main ()

[tavianator]

I believe the deadlock is here. AfterSleep() calls SlotLocker(thr):

llvm-project/compiler-rt/lib/tsan/rtl/tsan_rtl_mutex.cpp

Lines 516 to 525 in 47addd4

	void AfterSleep(ThreadState *thr, uptr pc) {
	DPrintf("#%d: AfterSleep\n", thr->tid);
	if (thr->ignore_sync)
	return;
	thr->last_sleep_stack_id = CurrentStackId(thr, pc);
	thr->last_sleep_clock.Reset();
	SlotLocker locker(thr);
	for (auto &slot : ctx->slots)
	thr->last_sleep_clock.Set(slot.sid, slot.epoch());
	}

But the loop is interrupted by a signal, and the handler tries an atomic operation, which tries to acquire the same lock:

llvm-project/compiler-rt/lib/tsan/rtl/tsan_interface_atomic.cpp

Line 452 in 47addd4

SlotLocker locker(thr);