[PATCH 1/1] linux-user: Hold the fd-trans lock across fork

[PATCH 1/1] linux-user: Hold the fd-trans lock across fork

[Geoffrey Thomas]

If another thread is holding target_fd_trans_lock during a fork, then the lock
becomes permanently locked in the child and the emulator deadlocks at the next
interaction with the fd-trans table. As with other locks, acquire the lock in
fork_start() and release it in fork_end().

Signed-off-by: Geoffrey Thomas <geofft@ldpreload.com>
Fixes: c093364f4d91 "fd-trans: Fix race condition on reallocation of the translation table."
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2846
Buglink: https://github.com/astral-sh/uv/issues/6105
---
 linux-user/fd-trans.h | 10 ++++++++++
 linux-user/main.c     |  2 ++
 2 files changed, 12 insertions(+)

diff --git a/linux-user/fd-trans.h b/linux-user/fd-trans.h
index 910faaf237..e14f96059c 100644
--- a/linux-user/fd-trans.h
+++ b/linux-user/fd-trans.h
@@ -36,6 +36,16 @@ static inline void fd_trans_init(void)
     qemu_mutex_init(&target_fd_trans_lock);
 }
 
+static inline void fd_trans_prefork(void)
+{
+    qemu_mutex_lock(&target_fd_trans_lock);
+}
+
+static inline void fd_trans_postfork(void)
+{
+    qemu_mutex_unlock(&target_fd_trans_lock);
+}
+
 static inline TargetFdDataFunc fd_trans_target_to_host_data(int fd)
 {
     if (fd < 0) {
diff --git a/linux-user/main.c b/linux-user/main.c
index e2ec5970be..2cd867491b 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -149,12 +149,14 @@ void fork_start(void)
     cpu_list_lock();
     qemu_plugin_user_prefork_lock();
     gdbserver_fork_start();
+    fd_trans_prefork();
 }
 
 void fork_end(pid_t pid)
 {
     bool child = pid == 0;
 
+    fd_trans_postfork();
     qemu_plugin_user_postfork(child);
     mmap_fork_end(child);
     if (child) {
-- 
2.39.5 (Apple Git-154)

Re: [PATCH 1/1] linux-user: Hold the fd-trans lock across fork

[Richard Henderson]

On 3/14/25 06:47, Geoffrey Thomas wrote:
> If another thread is holding target_fd_trans_lock during a fork, then the lock
> becomes permanently locked in the child and the emulator deadlocks at the next
> interaction with the fd-trans table. As with other locks, acquire the lock in
> fork_start() and release it in fork_end().
> 
> Signed-off-by: Geoffrey Thomas <geofft@ldpreload.com>
> Fixes: c093364f4d91 "fd-trans: Fix race condition on reallocation of the translation table."
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2846
> Buglink: https://github.com/astral-sh/uv/issues/6105
> ---
>   linux-user/fd-trans.h | 10 ++++++++++
>   linux-user/main.c     |  2 ++
>   2 files changed, 12 insertions(+)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

and queued, thanks.


r~