c5d972
This patch is a RHEL-8.7 backport of the following upstream commit:
c5d972
c5d972
commit 52a103e237329b9f88a28513fe7506ffc3bd8ced
c5d972
Author: Arjun Shankar <arjun@redhat.com>
c5d972
Date:   Tue May 24 17:57:36 2022 +0200
c5d972
c5d972
    Fix deadlock when pthread_atfork handler calls pthread_atfork or dlclose
c5d972
    
c5d972
    In multi-threaded programs, registering via pthread_atfork,
c5d972
    de-registering implicitly via dlclose, or running pthread_atfork
c5d972
    handlers during fork was protected by an internal lock.  This meant
c5d972
    that a pthread_atfork handler attempting to register another handler or
c5d972
    dlclose a dynamically loaded library would lead to a deadlock.
c5d972
    
c5d972
    This commit fixes the deadlock in the following way:
c5d972
    
c5d972
    During the execution of handlers at fork time, the atfork lock is
c5d972
    released prior to the execution of each handler and taken again upon its
c5d972
    return.  Any handler registrations or de-registrations that occurred
c5d972
    during the execution of the handler are accounted for before proceeding
c5d972
    with further handler execution.
c5d972
    
c5d972
    If a handler that hasn't been executed yet gets de-registered by another
c5d972
    handler during fork, it will not be executed.   If a handler gets
c5d972
    registered by another handler during fork, it will not be executed
c5d972
    during that particular fork.
c5d972
    
c5d972
    The possibility that handlers may now be registered or deregistered
c5d972
    during handler execution means that identifying the next handler to be
c5d972
    run after a given handler may register/de-register others requires some
c5d972
    bookkeeping.  The fork_handler struct has an additional field, 'id',
c5d972
    which is assigned sequentially during registration.  Thus, handlers are
c5d972
    executed in ascending order of 'id' during 'prepare', and descending
c5d972
    order of 'id' during parent/child handler execution after the fork.
c5d972
    
c5d972
    Two tests are included:
c5d972
    
c5d972
    * tst-atfork3: Adhemerval Zanella <adhemerval.zanella@linaro.org>
c5d972
      This test exercises calling dlclose from prepare, parent, and child
c5d972
      handlers.
c5d972
    
c5d972
    * tst-atfork4: This test exercises calling pthread_atfork and dlclose
c5d972
      from the prepare handler.
c5d972
    
c5d972
    [BZ #24595, BZ #27054]
c5d972
    
c5d972
    Co-authored-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
c5d972
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
c5d972
c5d972
diff --git a/nptl/Makefile b/nptl/Makefile
c5d972
index 70a3be23ecfcd9c9..76c914e23e8873f2 100644
c5d972
--- a/nptl/Makefile
c5d972
+++ b/nptl/Makefile
c5d972
@@ -382,8 +382,17 @@ tests += tst-cancelx2 tst-cancelx3 tst-cancelx4 tst-cancelx5 \
c5d972
 	 tst-cancelx16 tst-cancelx17 tst-cancelx18 tst-cancelx20 tst-cancelx21 \
c5d972
 	 tst-cleanupx0 tst-cleanupx1 tst-cleanupx2 tst-cleanupx3 tst-cleanupx4
c5d972
 ifeq ($(build-shared),yes)
c5d972
-tests += tst-atfork2 tst-tls4 tst-_res1 tst-fini1 tst-compat-forwarder \
c5d972
-	 tst-audit-threads
c5d972
+tests += \
c5d972
+  tst-atfork2 \
c5d972
+  tst-tls4 \
c5d972
+  tst-_res1 \
c5d972
+  tst-fini1 \
c5d972
+  tst-compat-forwarder \
c5d972
+  tst-audit-threads \
c5d972
+  tst-atfork3 \
c5d972
+  tst-atfork4 \
c5d972
+# tests
c5d972
+
c5d972
 tests-internal += tst-tls3 tst-tls3-malloc tst-tls5 tst-stackguard1
c5d972
 tests-nolibpthread += tst-fini1
c5d972
 ifeq ($(have-z-execstack),yes)
c5d972
@@ -391,18 +400,39 @@ tests += tst-execstack
c5d972
 endif
c5d972
 endif
c5d972
 
c5d972
-modules-names = tst-atfork2mod tst-tls3mod tst-tls4moda tst-tls4modb \
c5d972
-		tst-tls5mod tst-tls5moda tst-tls5modb tst-tls5modc \
c5d972
-		tst-tls5modd tst-tls5mode tst-tls5modf tst-stack4mod \
c5d972
-		tst-_res1mod1 tst-_res1mod2 tst-execstack-mod tst-fini1mod \
c5d972
-		tst-join7mod tst-compat-forwarder-mod tst-audit-threads-mod1 \
c5d972
-		tst-audit-threads-mod2
c5d972
+modules-names = \
c5d972
+  tst-atfork2mod \
c5d972
+  tst-tls3mod \
c5d972
+  tst-tls4moda \
c5d972
+  tst-tls4modb \
c5d972
+  tst-tls5mod \
c5d972
+  tst-tls5moda \
c5d972
+  tst-tls5modb \
c5d972
+  tst-tls5modc \
c5d972
+  tst-tls5modd \
c5d972
+  tst-tls5mode \
c5d972
+  tst-tls5modf \
c5d972
+  tst-stack4mod \
c5d972
+  tst-_res1mod1 \
c5d972
+  tst-_res1mod2 \
c5d972
+  tst-execstack-mod \
c5d972
+  tst-fini1mod \
c5d972
+  tst-join7mod \
c5d972
+  tst-compat-forwarder-mod \
c5d972
+  tst-audit-threads-mod1 \
c5d972
+  tst-audit-threads-mod2 \
c5d972
+  tst-atfork3mod \
c5d972
+  tst-atfork4mod \
c5d972
+# module-names
c5d972
+
c5d972
 extra-test-objs += $(addsuffix .os,$(strip $(modules-names))) \
c5d972
 		   tst-cleanup4aux.o tst-cleanupx4aux.o
c5d972
 test-extras += tst-cleanup4aux tst-cleanupx4aux
c5d972
 test-modules = $(addprefix $(objpfx),$(addsuffix .so,$(modules-names)))
c5d972
 
c5d972
 tst-atfork2mod.so-no-z-defs = yes
c5d972
+tst-atfork3mod.so-no-z-defs = yes
c5d972
+tst-atfork4mod.so-no-z-defs = yes
c5d972
 tst-tls3mod.so-no-z-defs = yes
c5d972
 tst-tls5mod.so-no-z-defs = yes
c5d972
 tst-tls5moda.so-no-z-defs = yes
c5d972
@@ -541,6 +571,14 @@ LDFLAGS-tst-atfork2 = -rdynamic
c5d972
 tst-atfork2-ENV = MALLOC_TRACE=$(objpfx)tst-atfork2.mtrace
c5d972
 $(objpfx)tst-atfork2mod.so: $(shared-thread-library)
c5d972
 
c5d972
+$(objpfx)tst-atfork3: $(libdl) $(shared-thread-library)
c5d972
+LDFLAGS-tst-atfork3 = -rdynamic
c5d972
+$(objpfx)tst-atfork3mod.so: $(shared-thread-library)
c5d972
+
c5d972
+$(objpfx)tst-atfork4: $(libdl) $(shared-thread-library)
c5d972
+LDFLAGS-tst-atfork4 = -rdynamic
c5d972
+$(objpfx)tst-atfork4mod.so: $(shared-thread-library)
c5d972
+
c5d972
 tst-stack3-ENV = MALLOC_TRACE=$(objpfx)tst-stack3.mtrace
c5d972
 $(objpfx)tst-stack3-mem.out: $(objpfx)tst-stack3.out
c5d972
 	$(common-objpfx)malloc/mtrace $(objpfx)tst-stack3.mtrace > $@; \
c5d972
@@ -640,6 +678,8 @@ $(objpfx)../libc.so: $(common-objpfx)libc.so ;
c5d972
 $(addprefix $(objpfx),$(tests-static) $(xtests-static)): $(objpfx)libpthread.a
c5d972
 
c5d972
 $(objpfx)tst-atfork2.out: $(objpfx)tst-atfork2mod.so
c5d972
+$(objpfx)tst-atfork3.out: $(objpfx)tst-atfork3mod.so
c5d972
+$(objpfx)tst-atfork4.out: $(objpfx)tst-atfork4mod.so
c5d972
 else
c5d972
 $(addprefix $(objpfx),$(tests) $(test-srcs)): $(objpfx)libpthread.a
c5d972
 endif
c5d972
diff --git a/nptl/register-atfork.c b/nptl/register-atfork.c
c5d972
index 9edb7d4bbb49fbed..4c1e20ae8cab005f 100644
c5d972
--- a/nptl/register-atfork.c
c5d972
+++ b/nptl/register-atfork.c
c5d972
@@ -21,6 +21,8 @@
c5d972
 #include <string.h>
c5d972
 #include <fork.h>
c5d972
 #include <atomic.h>
c5d972
+#include <intprops.h>
c5d972
+#include <stdio.h>
c5d972
 
c5d972
 #define DYNARRAY_ELEMENT           struct fork_handler
c5d972
 #define DYNARRAY_STRUCT            fork_handler_list
c5d972
@@ -29,7 +31,7 @@
c5d972
 #include <malloc/dynarray-skeleton.c>
c5d972
 
c5d972
 static struct fork_handler_list fork_handlers;
c5d972
-static bool fork_handler_init = false;
c5d972
+static uint64_t fork_handler_counter;
c5d972
 
c5d972
 static int atfork_lock = LLL_LOCK_INITIALIZER;
c5d972
 
c5d972
@@ -39,11 +41,8 @@ __register_atfork (void (*prepare) (void), void (*parent) (void),
c5d972
 {
c5d972
   lll_lock (atfork_lock, LLL_PRIVATE);
c5d972
 
c5d972
-  if (!fork_handler_init)
c5d972
-    {
c5d972
-      fork_handler_list_init (&fork_handlers);
c5d972
-      fork_handler_init = true;
c5d972
-    }
c5d972
+  if (fork_handler_counter == 0)
c5d972
+    fork_handler_list_init (&fork_handlers);
c5d972
 
c5d972
   struct fork_handler *newp = fork_handler_list_emplace (&fork_handlers);
c5d972
   if (newp != NULL)
c5d972
@@ -52,6 +51,13 @@ __register_atfork (void (*prepare) (void), void (*parent) (void),
c5d972
       newp->parent_handler = parent;
c5d972
       newp->child_handler = child;
c5d972
       newp->dso_handle = dso_handle;
c5d972
+
c5d972
+      /* IDs assigned to handlers start at 1 and increment with handler
c5d972
+         registration.  Un-registering a handlers discards the corresponding
c5d972
+         ID.  It is not reused in future registrations.  */
c5d972
+      if (INT_ADD_OVERFLOW (fork_handler_counter, 1))
c5d972
+        __libc_fatal ("fork handler counter overflow");
c5d972
+      newp->id = ++fork_handler_counter;
c5d972
     }
c5d972
 
c5d972
   /* Release the lock.  */
c5d972
@@ -106,37 +112,111 @@ __unregister_atfork (void *dso_handle)
c5d972
   lll_unlock (atfork_lock, LLL_PRIVATE);
c5d972
 }
c5d972
 
c5d972
-void
c5d972
-__run_fork_handlers (enum __run_fork_handler_type who, _Bool do_locking)
c5d972
+uint64_t
c5d972
+__run_prefork_handlers (_Bool do_locking)
c5d972
 {
c5d972
-  struct fork_handler *runp;
c5d972
+  uint64_t lastrun;
c5d972
 
c5d972
-  if (who == atfork_run_prepare)
c5d972
+  if (do_locking)
c5d972
+    lll_lock (atfork_lock, LLL_PRIVATE);
c5d972
+
c5d972
+  /* We run prepare handlers from last to first.  After fork, only
c5d972
+     handlers up to the last handler found here (pre-fork) will be run.
c5d972
+     Handlers registered during __run_prefork_handlers or
c5d972
+     __run_postfork_handlers will be positioned after this last handler, and
c5d972
+     since their prepare handlers won't be run now, their parent/child
c5d972
+     handlers should also be ignored.  */
c5d972
+  lastrun = fork_handler_counter;
c5d972
+
c5d972
+  size_t sl = fork_handler_list_size (&fork_handlers);
c5d972
+  for (size_t i = sl; i > 0;)
c5d972
     {
c5d972
-      if (do_locking)
c5d972
-	lll_lock (atfork_lock, LLL_PRIVATE);
c5d972
-      size_t sl = fork_handler_list_size (&fork_handlers);
c5d972
-      for (size_t i = sl; i > 0; i--)
c5d972
-	{
c5d972
-	  runp = fork_handler_list_at (&fork_handlers, i - 1);
c5d972
-	  if (runp->prepare_handler != NULL)
c5d972
-	    runp->prepare_handler ();
c5d972
-	}
c5d972
+      struct fork_handler *runp
c5d972
+        = fork_handler_list_at (&fork_handlers, i - 1);
c5d972
+
c5d972
+      uint64_t id = runp->id;
c5d972
+
c5d972
+      if (runp->prepare_handler != NULL)
c5d972
+        {
c5d972
+          if (do_locking)
c5d972
+            lll_unlock (atfork_lock, LLL_PRIVATE);
c5d972
+
c5d972
+          runp->prepare_handler ();
c5d972
+
c5d972
+          if (do_locking)
c5d972
+            lll_lock (atfork_lock, LLL_PRIVATE);
c5d972
+        }
c5d972
+
c5d972
+      /* We unlocked, ran the handler, and locked again.  In the
c5d972
+         meanwhile, one or more deregistrations could have occurred leading
c5d972
+         to the current (just run) handler being moved up the list or even
c5d972
+         removed from the list itself.  Since handler IDs are guaranteed to
c5d972
+         to be in increasing order, the next handler has to have:  */
c5d972
+
c5d972
+      /* A. An earlier position than the current one has.  */
c5d972
+      i--;
c5d972
+
c5d972
+      /* B. A lower ID than the current one does.  The code below skips
c5d972
+         any newly added handlers with higher IDs.  */
c5d972
+      while (i > 0
c5d972
+             && fork_handler_list_at (&fork_handlers, i - 1)->id >= id)
c5d972
+        i--;
c5d972
     }
c5d972
-  else
c5d972
+
c5d972
+  return lastrun;
c5d972
+}
c5d972
+
c5d972
+void
c5d972
+__run_postfork_handlers (enum __run_fork_handler_type who, _Bool do_locking,
c5d972
+                         uint64_t lastrun)
c5d972
+{
c5d972
+  size_t sl = fork_handler_list_size (&fork_handlers);
c5d972
+  for (size_t i = 0; i < sl;)
c5d972
     {
c5d972
-      size_t sl = fork_handler_list_size (&fork_handlers);
c5d972
-      for (size_t i = 0; i < sl; i++)
c5d972
-	{
c5d972
-	  runp = fork_handler_list_at (&fork_handlers, i);
c5d972
-	  if (who == atfork_run_child && runp->child_handler)
c5d972
-	    runp->child_handler ();
c5d972
-	  else if (who == atfork_run_parent && runp->parent_handler)
c5d972
-	    runp->parent_handler ();
c5d972
-	}
c5d972
+      struct fork_handler *runp = fork_handler_list_at (&fork_handlers, i);
c5d972
+      uint64_t id = runp->id;
c5d972
+
c5d972
+      /* prepare handlers were not run for handlers with ID > LASTRUN.
c5d972
+         Thus, parent/child handlers will also not be run.  */
c5d972
+      if (id > lastrun)
c5d972
+        break;
c5d972
+
c5d972
       if (do_locking)
c5d972
-	lll_unlock (atfork_lock, LLL_PRIVATE);
c5d972
+        lll_unlock (atfork_lock, LLL_PRIVATE);
c5d972
+
c5d972
+      if (who == atfork_run_child && runp->child_handler)
c5d972
+        runp->child_handler ();
c5d972
+      else if (who == atfork_run_parent && runp->parent_handler)
c5d972
+        runp->parent_handler ();
c5d972
+
c5d972
+      if (do_locking)
c5d972
+        lll_lock (atfork_lock, LLL_PRIVATE);
c5d972
+
c5d972
+      /* We unlocked, ran the handler, and locked again.  In the meanwhile,
c5d972
+         one or more [de]registrations could have occurred.  Due to this,
c5d972
+         the list size must be updated.  */
c5d972
+      sl = fork_handler_list_size (&fork_handlers);
c5d972
+
c5d972
+      /* The just-run handler could also have moved up the list. */
c5d972
+
c5d972
+      if (sl > i && fork_handler_list_at (&fork_handlers, i)->id == id)
c5d972
+        /* The position of the recently run handler hasn't changed.  The
c5d972
+           next handler to be run is an easy increment away.  */
c5d972
+        i++;
c5d972
+      else
c5d972
+        {
c5d972
+          /* The next handler to be run is the first handler in the list
c5d972
+             to have an ID higher than the current one.  */
c5d972
+          for (i = 0; i < sl; i++)
c5d972
+            {
c5d972
+              if (fork_handler_list_at (&fork_handlers, i)->id > id)
c5d972
+                break;
c5d972
+            }
c5d972
+        }
c5d972
     }
c5d972
+
c5d972
+  if (do_locking)
c5d972
+    lll_unlock (atfork_lock, LLL_PRIVATE);
c5d972
 }
c5d972
 
c5d972
 
c5d972
diff --git a/nptl/tst-atfork3.c b/nptl/tst-atfork3.c
c5d972
new file mode 100644
c5d972
index 0000000000000000..bb2250e432ab79ad
c5d972
--- /dev/null
c5d972
+++ b/nptl/tst-atfork3.c
c5d972
@@ -0,0 +1,118 @@
c5d972
+/* Check if pthread_atfork handler can call dlclose (BZ#24595).
c5d972
+   Copyright (C) 2022 Free Software Foundation, Inc.
c5d972
+   This file is part of the GNU C Library.
c5d972
+
c5d972
+   The GNU C Library is free software; you can redistribute it and/or
c5d972
+   modify it under the terms of the GNU Lesser General Public
c5d972
+   License as published by the Free Software Foundation; either
c5d972
+   version 2.1 of the License, or (at your option) any later version.
c5d972
+
c5d972
+   The GNU C Library is distributed in the hope that it will be useful,
c5d972
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
c5d972
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
c5d972
+   Lesser General Public License for more details.
c5d972
+
c5d972
+   You should have received a copy of the GNU Lesser General Public
c5d972
+   License along with the GNU C Library; if not, see
c5d972
+   <http://www.gnu.org/licenses/>.  */
c5d972
+
c5d972
+#include <stdio.h>
c5d972
+#include <pthread.h>
c5d972
+#include <unistd.h>
c5d972
+#include <stdlib.h>
c5d972
+#include <stdbool.h>
c5d972
+
c5d972
+#include <support/check.h>
c5d972
+#include <support/xthread.h>
c5d972
+#include <support/capture_subprocess.h>
c5d972
+#include <support/xdlfcn.h>
c5d972
+
c5d972
+/* Check if pthread_atfork handlers do not deadlock when calling a function
c5d972
+   that might alter the internal fork handle list, such as dlclose.
c5d972
+
c5d972
+   The test registers a callback set with pthread_atfork(), dlopen() a shared
c5d972
+   library (nptl/tst-atfork3mod.c), calls an exported symbol from the library
c5d972
+   (which in turn also registers atfork handlers), and calls fork to trigger
c5d972
+   the callbacks.  */
c5d972
+
c5d972
+static void *handler;
c5d972
+static bool run_dlclose_prepare;
c5d972
+static bool run_dlclose_parent;
c5d972
+static bool run_dlclose_child;
c5d972
+
c5d972
+static void
c5d972
+prepare (void)
c5d972
+{
c5d972
+  if (run_dlclose_prepare)
c5d972
+    xdlclose (handler);
c5d972
+}
c5d972
+
c5d972
+static void
c5d972
+parent (void)
c5d972
+{
c5d972
+  if (run_dlclose_parent)
c5d972
+    xdlclose (handler);
c5d972
+}
c5d972
+
c5d972
+static void
c5d972
+child (void)
c5d972
+{
c5d972
+  if (run_dlclose_child)
c5d972
+    xdlclose (handler);
c5d972
+}
c5d972
+
c5d972
+static void
c5d972
+proc_func (void *closure)
c5d972
+{
c5d972
+}
c5d972
+
c5d972
+static void
c5d972
+do_test_generic (bool dlclose_prepare, bool dlclose_parent, bool dlclose_child)
c5d972
+{
c5d972
+  run_dlclose_prepare = dlclose_prepare;
c5d972
+  run_dlclose_parent = dlclose_parent;
c5d972
+  run_dlclose_child = dlclose_child;
c5d972
+
c5d972
+  handler = xdlopen ("tst-atfork3mod.so", RTLD_NOW);
c5d972
+
c5d972
+  int (*atfork3mod_func)(void);
c5d972
+  atfork3mod_func = xdlsym (handler, "atfork3mod_func");
c5d972
+
c5d972
+  atfork3mod_func ();
c5d972
+
c5d972
+  struct support_capture_subprocess proc
c5d972
+    = support_capture_subprocess (proc_func, NULL);
c5d972
+  support_capture_subprocess_check (&proc, "tst-atfork3", 0, sc_allow_none);
c5d972
+
c5d972
+  handler = atfork3mod_func = NULL;
c5d972
+
c5d972
+  support_capture_subprocess_free (&proc;;
c5d972
+}
c5d972
+
c5d972
+static void *
c5d972
+thread_func (void *closure)
c5d972
+{
c5d972
+  return NULL;
c5d972
+}
c5d972
+
c5d972
+static int
c5d972
+do_test (void)
c5d972
+{
c5d972
+  {
c5d972
+    /* Make the process acts as multithread.  */
c5d972
+    pthread_attr_t attr;
c5d972
+    xpthread_attr_init (&attr);
c5d972
+    xpthread_attr_setdetachstate (&attr, PTHREAD_CREATE_DETACHED);
c5d972
+    xpthread_create (&attr, thread_func, NULL);
c5d972
+  }
c5d972
+
c5d972
+  TEST_COMPARE (pthread_atfork (prepare, parent, child), 0);
c5d972
+
c5d972
+  do_test_generic (true  /* prepare */, false /* parent */, false /* child */);
c5d972
+  do_test_generic (false /* prepare */, true  /* parent */, false /* child */);
c5d972
+  do_test_generic (false /* prepare */, false /* parent */, true  /* child */);
c5d972
+
c5d972
+  return 0;
c5d972
+}
c5d972
+
c5d972
+#include <support/test-driver.c>
c5d972
diff --git a/nptl/tst-atfork3mod.c b/nptl/tst-atfork3mod.c
c5d972
new file mode 100644
c5d972
index 0000000000000000..6d0658cb9efdecbc
c5d972
--- /dev/null
c5d972
+++ b/nptl/tst-atfork3mod.c
c5d972
@@ -0,0 +1,44 @@
c5d972
+/* Copyright (C) 2022 Free Software Foundation, Inc.
c5d972
+   This file is part of the GNU C Library.
c5d972
+
c5d972
+   The GNU C Library is free software; you can redistribute it and/or
c5d972
+   modify it under the terms of the GNU Lesser General Public
c5d972
+   License as published by the Free Software Foundation; either
c5d972
+   version 2.1 of the License, or (at your option) any later version.
c5d972
+
c5d972
+   The GNU C Library is distributed in the hope that it will be useful,
c5d972
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
c5d972
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
c5d972
+   Lesser General Public License for more details.
c5d972
+
c5d972
+   You should have received a copy of the GNU Lesser General Public
c5d972
+   License along with the GNU C Library; if not, see
c5d972
+   <http://www.gnu.org/licenses/>.  */
c5d972
+
c5d972
+#include <unistd.h>
c5d972
+#include <stdlib.h>
c5d972
+#include <pthread.h>
c5d972
+
c5d972
+#include <support/check.h>
c5d972
+
c5d972
+static void
c5d972
+mod_prepare (void)
c5d972
+{
c5d972
+}
c5d972
+
c5d972
+static void
c5d972
+mod_parent (void)
c5d972
+{
c5d972
+}
c5d972
+
c5d972
+static void
c5d972
+mod_child (void)
c5d972
+{
c5d972
+}
c5d972
+
c5d972
+int atfork3mod_func (void)
c5d972
+{
c5d972
+  TEST_COMPARE (pthread_atfork (mod_prepare, mod_parent, mod_child), 0);
c5d972
+
c5d972
+  return 0;
c5d972
+}
c5d972
diff --git a/nptl/tst-atfork4.c b/nptl/tst-atfork4.c
c5d972
new file mode 100644
c5d972
index 0000000000000000..52dc87e73b846ab9
c5d972
--- /dev/null
c5d972
+++ b/nptl/tst-atfork4.c
c5d972
@@ -0,0 +1,128 @@
c5d972
+/* pthread_atfork supports handlers that call pthread_atfork or dlclose.
c5d972
+   Copyright (C) 2022 Free Software Foundation, Inc.
c5d972
+   This file is part of the GNU C Library.
c5d972
+
c5d972
+   The GNU C Library is free software; you can redistribute it and/or
c5d972
+   modify it under the terms of the GNU Lesser General Public
c5d972
+   License as published by the Free Software Foundation; either
c5d972
+   version 2.1 of the License, or (at your option) any later version.
c5d972
+
c5d972
+   The GNU C Library is distributed in the hope that it will be useful,
c5d972
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
c5d972
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
c5d972
+   Lesser General Public License for more details.
c5d972
+
c5d972
+   You should have received a copy of the GNU Lesser General Public
c5d972
+   License along with the GNU C Library; if not, see
c5d972
+   <https://www.gnu.org/licenses/>.  */
c5d972
+
c5d972
+#include <support/xdlfcn.h>
c5d972
+#include <stdio.h>
c5d972
+#include <support/xthread.h>
c5d972
+#include <sys/types.h>
c5d972
+#include <sys/wait.h>
c5d972
+#include <support/xunistd.h>
c5d972
+#include <support/check.h>
c5d972
+#include <stdlib.h>
c5d972
+
c5d972
+static void *
c5d972
+thread_func (void *x)
c5d972
+{
c5d972
+  return NULL;
c5d972
+}
c5d972
+
c5d972
+static unsigned int second_atfork_handler_runcount = 0;
c5d972
+
c5d972
+static void
c5d972
+second_atfork_handler (void)
c5d972
+{
c5d972
+  second_atfork_handler_runcount++;
c5d972
+}
c5d972
+
c5d972
+static void *h = NULL;
c5d972
+
c5d972
+static unsigned int atfork_handler_runcount = 0;
c5d972
+
c5d972
+static void
c5d972
+prepare (void)
c5d972
+{
c5d972
+  /* These atfork handlers are registered while atfork handlers are being
c5d972
+     executed and thus will not be executed during the corresponding
c5d972
+     fork.  */
c5d972
+  TEST_VERIFY_EXIT (pthread_atfork (second_atfork_handler,
c5d972
+                                    second_atfork_handler,
c5d972
+                                    second_atfork_handler) == 0);
c5d972
+
c5d972
+  /* This will de-register the atfork handlers registered by the dlopen'd
c5d972
+     library and so they will not be executed.  */
c5d972
+  if (h != NULL)
c5d972
+    {
c5d972
+      xdlclose (h);
c5d972
+      h = NULL;
c5d972
+    }
c5d972
+
c5d972
+  atfork_handler_runcount++;
c5d972
+}
c5d972
+
c5d972
+static void
c5d972
+after (void)
c5d972
+{
c5d972
+  atfork_handler_runcount++;
c5d972
+}
c5d972
+
c5d972
+static int
c5d972
+do_test (void)
c5d972
+{
c5d972
+  /* Make sure __libc_single_threaded is 0.  */
c5d972
+  pthread_attr_t attr;
c5d972
+  xpthread_attr_init (&attr);
c5d972
+  xpthread_attr_setdetachstate (&attr, PTHREAD_CREATE_DETACHED);
c5d972
+  xpthread_create (&attr, thread_func, NULL);
c5d972
+
c5d972
+  void (*reg_atfork_handlers) (void);
c5d972
+
c5d972
+  h = xdlopen ("tst-atfork4mod.so", RTLD_LAZY);
c5d972
+
c5d972
+  reg_atfork_handlers = xdlsym (h, "reg_atfork_handlers");
c5d972
+
c5d972
+  reg_atfork_handlers ();
c5d972
+
c5d972
+  /* We register our atfork handlers *after* loading the module so that our
c5d972
+     prepare handler is called first at fork, where we then dlclose the
c5d972
+     module before its prepare handler has a chance to be called.  */
c5d972
+  TEST_VERIFY_EXIT (pthread_atfork (prepare, after, after) == 0);
c5d972
+
c5d972
+  pid_t pid = xfork ();
c5d972
+
c5d972
+  /* Both the parent and the child processes should observe this.  */
c5d972
+  TEST_VERIFY_EXIT (atfork_handler_runcount == 2);
c5d972
+  TEST_VERIFY_EXIT (second_atfork_handler_runcount == 0);
c5d972
+
c5d972
+  if (pid > 0)
c5d972
+    {
c5d972
+      int childstat;
c5d972
+
c5d972
+      xwaitpid (-1, &childstat, 0);
c5d972
+      TEST_VERIFY_EXIT (WIFEXITED (childstat)
c5d972
+                        && WEXITSTATUS (childstat) == 0);
c5d972
+
c5d972
+      /* This time, the second set of atfork handlers should also be called
c5d972
+         since the handlers are already in place before fork is called.  */
c5d972
+
c5d972
+      pid = xfork ();
c5d972
+
c5d972
+      TEST_VERIFY_EXIT (atfork_handler_runcount == 4);
c5d972
+      TEST_VERIFY_EXIT (second_atfork_handler_runcount == 2);
c5d972
+
c5d972
+      if (pid > 0)
c5d972
+        {
c5d972
+          xwaitpid (-1, &childstat, 0);
c5d972
+          TEST_VERIFY_EXIT (WIFEXITED (childstat)
c5d972
+                            && WEXITSTATUS (childstat) == 0);
c5d972
+        }
c5d972
+    }
c5d972
+
c5d972
+  return 0;
c5d972
+}
c5d972
+
c5d972
+#include <support/test-driver.c>
c5d972
diff --git a/nptl/tst-atfork4mod.c b/nptl/tst-atfork4mod.c
c5d972
new file mode 100644
c5d972
index 0000000000000000..e111efeb185916e0
c5d972
--- /dev/null
c5d972
+++ b/nptl/tst-atfork4mod.c
c5d972
@@ -0,0 +1,48 @@
c5d972
+/* pthread_atfork supports handlers that call pthread_atfork or dlclose.
c5d972
+   Copyright (C) 2022 Free Software Foundation, Inc.
c5d972
+   This file is part of the GNU C Library.
c5d972
+
c5d972
+   The GNU C Library is free software; you can redistribute it and/or
c5d972
+   modify it under the terms of the GNU Lesser General Public
c5d972
+   License as published by the Free Software Foundation; either
c5d972
+   version 2.1 of the License, or (at your option) any later version.
c5d972
+
c5d972
+   The GNU C Library is distributed in the hope that it will be useful,
c5d972
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
c5d972
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
c5d972
+   Lesser General Public License for more details.
c5d972
+
c5d972
+   You should have received a copy of the GNU Lesser General Public
c5d972
+   License along with the GNU C Library; if not, see
c5d972
+   <https://www.gnu.org/licenses/>.  */
c5d972
+
c5d972
+#include <pthread.h>
c5d972
+#include <stdlib.h>
c5d972
+
c5d972
+/* This dynamically loaded library simply registers its atfork handlers when
c5d972
+   asked to.  The atfork handlers should never be executed because the
c5d972
+   library is unloaded before fork is called by the test program.  */
c5d972
+
c5d972
+static void
c5d972
+prepare (void)
c5d972
+{
c5d972
+  abort ();
c5d972
+}
c5d972
+
c5d972
+static void
c5d972
+parent (void)
c5d972
+{
c5d972
+  abort ();
c5d972
+}
c5d972
+
c5d972
+static void
c5d972
+child (void)
c5d972
+{
c5d972
+  abort ();
c5d972
+}
c5d972
+
c5d972
+void
c5d972
+reg_atfork_handlers (void)
c5d972
+{
c5d972
+  pthread_atfork (prepare, parent, child);
c5d972
+}
c5d972
diff --git a/sysdeps/nptl/fork.c b/sysdeps/nptl/fork.c
c5d972
index b4d20fa652f4ba3b..1324b813136764fc 100644
c5d972
--- a/sysdeps/nptl/fork.c
c5d972
+++ b/sysdeps/nptl/fork.c
c5d972
@@ -54,8 +54,9 @@ __libc_fork (void)
c5d972
      signal handlers.  POSIX requires that fork is async-signal-safe,
c5d972
      but our current fork implementation is not.  */
c5d972
   bool multiple_threads = THREAD_GETMEM (THREAD_SELF, header.multiple_threads);
c5d972
+  uint64_t lastrun;
c5d972
 
c5d972
-  __run_fork_handlers (atfork_run_prepare, multiple_threads);
c5d972
+  lastrun = __run_prefork_handlers (multiple_threads);
c5d972
 
c5d972
   /* If we are not running multiple threads, we do not have to
c5d972
      preserve lock state.  If fork runs from a signal handler, only
c5d972
@@ -129,7 +130,7 @@ __libc_fork (void)
c5d972
       __rtld_lock_initialize (GL(dl_load_tls_lock));
c5d972
 
c5d972
       /* Run the handlers registered for the child.  */
c5d972
-      __run_fork_handlers (atfork_run_child, multiple_threads);
c5d972
+      __run_postfork_handlers (atfork_run_child, multiple_threads, lastrun);
c5d972
     }
c5d972
   else
c5d972
     {
c5d972
@@ -144,7 +145,7 @@ __libc_fork (void)
c5d972
 	}
c5d972
 
c5d972
       /* Run the handlers registered for the parent.  */
c5d972
-      __run_fork_handlers (atfork_run_parent, multiple_threads);
c5d972
+      __run_postfork_handlers (atfork_run_parent, multiple_threads, lastrun);
c5d972
     }
c5d972
 
c5d972
   return pid;
c5d972
diff --git a/sysdeps/nptl/fork.h b/sysdeps/nptl/fork.h
c5d972
index bef2b7a8a6af8635..222c4f618970a455 100644
c5d972
--- a/sysdeps/nptl/fork.h
c5d972
+++ b/sysdeps/nptl/fork.h
c5d972
@@ -31,6 +31,7 @@ struct fork_handler
c5d972
   void (*parent_handler) (void);
c5d972
   void (*child_handler) (void);
c5d972
   void *dso_handle;
c5d972
+  uint64_t id;
c5d972
 };
c5d972
 
c5d972
 /* Function to call to unregister fork handlers.  */
c5d972
@@ -44,19 +45,18 @@ enum __run_fork_handler_type
c5d972
   atfork_run_parent
c5d972
 };
c5d972
 
c5d972
-/* Run the atfork handlers and lock/unlock the internal lock depending
c5d972
-   of the WHO argument:
c5d972
+/* Run the atfork prepare handlers in the reverse order of registration and
c5d972
+   return the ID of the last registered handler.  If DO_LOCKING is true, the
c5d972
+   internal lock is held locked upon return.  */
c5d972
+extern uint64_t __run_prefork_handlers (_Bool do_locking) attribute_hidden;
c5d972
 
c5d972
-   - atfork_run_prepare: run all the PREPARE_HANDLER in reverse order of
c5d972
-			 insertion and locks the internal lock.
c5d972
-   - atfork_run_child: run all the CHILD_HANDLER and unlocks the internal
c5d972
-		       lock.
c5d972
-   - atfork_run_parent: run all the PARENT_HANDLER and unlocks the internal
c5d972
-			lock.
c5d972
-
c5d972
-   Perform locking only if DO_LOCKING.  */
c5d972
-extern void __run_fork_handlers (enum __run_fork_handler_type who,
c5d972
-				 _Bool do_locking) attribute_hidden;
c5d972
+/* Given a handler type (parent or child), run all the atfork handlers in
c5d972
+   the order of registration up to and including the handler with id equal
c5d972
+   to LASTRUN.  If DO_LOCKING is true, the internal lock is unlocked prior
c5d972
+   to return.  */
c5d972
+extern void __run_postfork_handlers (enum __run_fork_handler_type who,
c5d972
+                                     _Bool do_locking,
c5d972
+                                     uint64_t lastrun) attribute_hidden;
c5d972
 
c5d972
 /* C library side function to register new fork handlers.  */
c5d972
 extern int __register_atfork (void (*__prepare) (void),