08c3a6
commit ff450cdbdee0b8cb6b9d653d6d2fa892de29be31
08c3a6
Author: Arjun Shankar <arjun@redhat.com>
08c3a6
Date:   Tue May 24 17:57:36 2022 +0200
08c3a6
08c3a6
    Fix deadlock when pthread_atfork handler calls pthread_atfork or dlclose
08c3a6
    
08c3a6
    In multi-threaded programs, registering via pthread_atfork,
08c3a6
    de-registering implicitly via dlclose, or running pthread_atfork
08c3a6
    handlers during fork was protected by an internal lock.  This meant
08c3a6
    that a pthread_atfork handler attempting to register another handler or
08c3a6
    dlclose a dynamically loaded library would lead to a deadlock.
08c3a6
    
08c3a6
    This commit fixes the deadlock in the following way:
08c3a6
    
08c3a6
    During the execution of handlers at fork time, the atfork lock is
08c3a6
    released prior to the execution of each handler and taken again upon its
08c3a6
    return.  Any handler registrations or de-registrations that occurred
08c3a6
    during the execution of the handler are accounted for before proceeding
08c3a6
    with further handler execution.
08c3a6
    
08c3a6
    If a handler that hasn't been executed yet gets de-registered by another
08c3a6
    handler during fork, it will not be executed.   If a handler gets
08c3a6
    registered by another handler during fork, it will not be executed
08c3a6
    during that particular fork.
08c3a6
    
08c3a6
    The possibility that handlers may now be registered or deregistered
08c3a6
    during handler execution means that identifying the next handler to be
08c3a6
    run after a given handler may register/de-register others requires some
08c3a6
    bookkeeping.  The fork_handler struct has an additional field, 'id',
08c3a6
    which is assigned sequentially during registration.  Thus, handlers are
08c3a6
    executed in ascending order of 'id' during 'prepare', and descending
08c3a6
    order of 'id' during parent/child handler execution after the fork.
08c3a6
    
08c3a6
    Two tests are included:
08c3a6
    
08c3a6
    * tst-atfork3: Adhemerval Zanella <adhemerval.zanella@linaro.org>
08c3a6
      This test exercises calling dlclose from prepare, parent, and child
08c3a6
      handlers.
08c3a6
    
08c3a6
    * tst-atfork4: This test exercises calling pthread_atfork and dlclose
08c3a6
      from the prepare handler.
08c3a6
    
08c3a6
    [BZ #24595, BZ #27054]
08c3a6
    
08c3a6
    Co-authored-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
08c3a6
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
08c3a6
    (cherry picked from commit 52a103e237329b9f88a28513fe7506ffc3bd8ced)
08c3a6
08c3a6
diff --git a/include/register-atfork.h b/include/register-atfork.h
08c3a6
index fadde14700947ac6..6d7bfd87688d6530 100644
08c3a6
--- a/include/register-atfork.h
08c3a6
+++ b/include/register-atfork.h
08c3a6
@@ -26,6 +26,7 @@ struct fork_handler
08c3a6
   void (*parent_handler) (void);
08c3a6
   void (*child_handler) (void);
08c3a6
   void *dso_handle;
08c3a6
+  uint64_t id;
08c3a6
 };
08c3a6
 
08c3a6
 /* Function to call to unregister fork handlers.  */
08c3a6
@@ -39,19 +40,18 @@ enum __run_fork_handler_type
08c3a6
   atfork_run_parent
08c3a6
 };
08c3a6
 
08c3a6
-/* Run the atfork handlers and lock/unlock the internal lock depending
08c3a6
-   of the WHO argument:
08c3a6
-
08c3a6
-   - atfork_run_prepare: run all the PREPARE_HANDLER in reverse order of
08c3a6
-			 insertion and locks the internal lock.
08c3a6
-   - atfork_run_child: run all the CHILD_HANDLER and unlocks the internal
08c3a6
-		       lock.
08c3a6
-   - atfork_run_parent: run all the PARENT_HANDLER and unlocks the internal
08c3a6
-			lock.
08c3a6
-
08c3a6
-   Perform locking only if DO_LOCKING.  */
08c3a6
-extern void __run_fork_handlers (enum __run_fork_handler_type who,
08c3a6
-				 _Bool do_locking) attribute_hidden;
08c3a6
+/* Run the atfork prepare handlers in the reverse order of registration and
08c3a6
+   return the ID of the last registered handler.  If DO_LOCKING is true, the
08c3a6
+   internal lock is held locked upon return.  */
08c3a6
+extern uint64_t __run_prefork_handlers (_Bool do_locking) attribute_hidden;
08c3a6
+
08c3a6
+/* Given a handler type (parent or child), run all the atfork handlers in
08c3a6
+   the order of registration up to and including the handler with id equal
08c3a6
+   to LASTRUN.  If DO_LOCKING is true, the internal lock is unlocked prior
08c3a6
+   to return.  */
08c3a6
+extern void __run_postfork_handlers (enum __run_fork_handler_type who,
08c3a6
+                                     _Bool do_locking,
08c3a6
+                                     uint64_t lastrun) attribute_hidden;
08c3a6
 
08c3a6
 /* C library side function to register new fork handlers.  */
08c3a6
 extern int __register_atfork (void (*__prepare) (void),
08c3a6
diff --git a/posix/fork.c b/posix/fork.c
08c3a6
index 021691b9b7441f15..890b806eb48cb75a 100644
08c3a6
--- a/posix/fork.c
08c3a6
+++ b/posix/fork.c
08c3a6
@@ -46,8 +46,9 @@ __libc_fork (void)
08c3a6
      best effort to make is async-signal-safe at least for single-thread
08c3a6
      case.  */
08c3a6
   bool multiple_threads = __libc_single_threaded == 0;
08c3a6
+  uint64_t lastrun;
08c3a6
 
08c3a6
-  __run_fork_handlers (atfork_run_prepare, multiple_threads);
08c3a6
+  lastrun = __run_prefork_handlers (multiple_threads);
08c3a6
 
08c3a6
   struct nss_database_data nss_database_data;
08c3a6
 
08c3a6
@@ -105,7 +106,7 @@ __libc_fork (void)
08c3a6
       reclaim_stacks ();
08c3a6
 
08c3a6
       /* Run the handlers registered for the child.  */
08c3a6
-      __run_fork_handlers (atfork_run_child, multiple_threads);
08c3a6
+      __run_postfork_handlers (atfork_run_child, multiple_threads, lastrun);
08c3a6
     }
08c3a6
   else
08c3a6
     {
08c3a6
@@ -123,7 +124,7 @@ __libc_fork (void)
08c3a6
 	}
08c3a6
 
08c3a6
       /* Run the handlers registered for the parent.  */
08c3a6
-      __run_fork_handlers (atfork_run_parent, multiple_threads);
08c3a6
+      __run_postfork_handlers (atfork_run_parent, multiple_threads, lastrun);
08c3a6
 
08c3a6
       if (pid < 0)
08c3a6
 	__set_errno (save_errno);
08c3a6
diff --git a/posix/register-atfork.c b/posix/register-atfork.c
08c3a6
index 6fd9e4c56aafd7cc..6370437aa68e039e 100644
08c3a6
--- a/posix/register-atfork.c
08c3a6
+++ b/posix/register-atfork.c
08c3a6
@@ -19,6 +19,8 @@
08c3a6
 #include <libc-lock.h>
08c3a6
 #include <stdbool.h>
08c3a6
 #include <register-atfork.h>
08c3a6
+#include <intprops.h>
08c3a6
+#include <stdio.h>
08c3a6
 
08c3a6
 #define DYNARRAY_ELEMENT           struct fork_handler
08c3a6
 #define DYNARRAY_STRUCT            fork_handler_list
08c3a6
@@ -27,7 +29,7 @@
08c3a6
 #include <malloc/dynarray-skeleton.c>
08c3a6
 
08c3a6
 static struct fork_handler_list fork_handlers;
08c3a6
-static bool fork_handler_init = false;
08c3a6
+static uint64_t fork_handler_counter;
08c3a6
 
08c3a6
 static int atfork_lock = LLL_LOCK_INITIALIZER;
08c3a6
 
08c3a6
@@ -37,11 +39,8 @@ __register_atfork (void (*prepare) (void), void (*parent) (void),
08c3a6
 {
08c3a6
   lll_lock (atfork_lock, LLL_PRIVATE);
08c3a6
 
08c3a6
-  if (!fork_handler_init)
08c3a6
-    {
08c3a6
-      fork_handler_list_init (&fork_handlers);
08c3a6
-      fork_handler_init = true;
08c3a6
-    }
08c3a6
+  if (fork_handler_counter == 0)
08c3a6
+    fork_handler_list_init (&fork_handlers);
08c3a6
 
08c3a6
   struct fork_handler *newp = fork_handler_list_emplace (&fork_handlers);
08c3a6
   if (newp != NULL)
08c3a6
@@ -50,6 +49,13 @@ __register_atfork (void (*prepare) (void), void (*parent) (void),
08c3a6
       newp->parent_handler = parent;
08c3a6
       newp->child_handler = child;
08c3a6
       newp->dso_handle = dso_handle;
08c3a6
+
08c3a6
+      /* IDs assigned to handlers start at 1 and increment with handler
08c3a6
+         registration.  Un-registering a handlers discards the corresponding
08c3a6
+         ID.  It is not reused in future registrations.  */
08c3a6
+      if (INT_ADD_OVERFLOW (fork_handler_counter, 1))
08c3a6
+        __libc_fatal ("fork handler counter overflow");
08c3a6
+      newp->id = ++fork_handler_counter;
08c3a6
     }
08c3a6
 
08c3a6
   /* Release the lock.  */
08c3a6
@@ -104,37 +110,111 @@ __unregister_atfork (void *dso_handle)
08c3a6
   lll_unlock (atfork_lock, LLL_PRIVATE);
08c3a6
 }
08c3a6
 
08c3a6
-void
08c3a6
-__run_fork_handlers (enum __run_fork_handler_type who, _Bool do_locking)
08c3a6
+uint64_t
08c3a6
+__run_prefork_handlers (_Bool do_locking)
08c3a6
 {
08c3a6
-  struct fork_handler *runp;
08c3a6
+  uint64_t lastrun;
08c3a6
 
08c3a6
-  if (who == atfork_run_prepare)
08c3a6
+  if (do_locking)
08c3a6
+    lll_lock (atfork_lock, LLL_PRIVATE);
08c3a6
+
08c3a6
+  /* We run prepare handlers from last to first.  After fork, only
08c3a6
+     handlers up to the last handler found here (pre-fork) will be run.
08c3a6
+     Handlers registered during __run_prefork_handlers or
08c3a6
+     __run_postfork_handlers will be positioned after this last handler, and
08c3a6
+     since their prepare handlers won't be run now, their parent/child
08c3a6
+     handlers should also be ignored.  */
08c3a6
+  lastrun = fork_handler_counter;
08c3a6
+
08c3a6
+  size_t sl = fork_handler_list_size (&fork_handlers);
08c3a6
+  for (size_t i = sl; i > 0;)
08c3a6
     {
08c3a6
-      if (do_locking)
08c3a6
-	lll_lock (atfork_lock, LLL_PRIVATE);
08c3a6
-      size_t sl = fork_handler_list_size (&fork_handlers);
08c3a6
-      for (size_t i = sl; i > 0; i--)
08c3a6
-	{
08c3a6
-	  runp = fork_handler_list_at (&fork_handlers, i - 1);
08c3a6
-	  if (runp->prepare_handler != NULL)
08c3a6
-	    runp->prepare_handler ();
08c3a6
-	}
08c3a6
+      struct fork_handler *runp
08c3a6
+        = fork_handler_list_at (&fork_handlers, i - 1);
08c3a6
+
08c3a6
+      uint64_t id = runp->id;
08c3a6
+
08c3a6
+      if (runp->prepare_handler != NULL)
08c3a6
+        {
08c3a6
+          if (do_locking)
08c3a6
+            lll_unlock (atfork_lock, LLL_PRIVATE);
08c3a6
+
08c3a6
+          runp->prepare_handler ();
08c3a6
+
08c3a6
+          if (do_locking)
08c3a6
+            lll_lock (atfork_lock, LLL_PRIVATE);
08c3a6
+        }
08c3a6
+
08c3a6
+      /* We unlocked, ran the handler, and locked again.  In the
08c3a6
+         meanwhile, one or more deregistrations could have occurred leading
08c3a6
+         to the current (just run) handler being moved up the list or even
08c3a6
+         removed from the list itself.  Since handler IDs are guaranteed to
08c3a6
+         to be in increasing order, the next handler has to have:  */
08c3a6
+
08c3a6
+      /* A. An earlier position than the current one has.  */
08c3a6
+      i--;
08c3a6
+
08c3a6
+      /* B. A lower ID than the current one does.  The code below skips
08c3a6
+         any newly added handlers with higher IDs.  */
08c3a6
+      while (i > 0
08c3a6
+             && fork_handler_list_at (&fork_handlers, i - 1)->id >= id)
08c3a6
+        i--;
08c3a6
     }
08c3a6
-  else
08c3a6
+
08c3a6
+  return lastrun;
08c3a6
+}
08c3a6
+
08c3a6
+void
08c3a6
+__run_postfork_handlers (enum __run_fork_handler_type who, _Bool do_locking,
08c3a6
+                         uint64_t lastrun)
08c3a6
+{
08c3a6
+  size_t sl = fork_handler_list_size (&fork_handlers);
08c3a6
+  for (size_t i = 0; i < sl;)
08c3a6
     {
08c3a6
-      size_t sl = fork_handler_list_size (&fork_handlers);
08c3a6
-      for (size_t i = 0; i < sl; i++)
08c3a6
-	{
08c3a6
-	  runp = fork_handler_list_at (&fork_handlers, i);
08c3a6
-	  if (who == atfork_run_child && runp->child_handler)
08c3a6
-	    runp->child_handler ();
08c3a6
-	  else if (who == atfork_run_parent && runp->parent_handler)
08c3a6
-	    runp->parent_handler ();
08c3a6
-	}
08c3a6
+      struct fork_handler *runp = fork_handler_list_at (&fork_handlers, i);
08c3a6
+      uint64_t id = runp->id;
08c3a6
+
08c3a6
+      /* prepare handlers were not run for handlers with ID > LASTRUN.
08c3a6
+         Thus, parent/child handlers will also not be run.  */
08c3a6
+      if (id > lastrun)
08c3a6
+        break;
08c3a6
+
08c3a6
       if (do_locking)
08c3a6
-	lll_unlock (atfork_lock, LLL_PRIVATE);
08c3a6
+        lll_unlock (atfork_lock, LLL_PRIVATE);
08c3a6
+
08c3a6
+      if (who == atfork_run_child && runp->child_handler)
08c3a6
+        runp->child_handler ();
08c3a6
+      else if (who == atfork_run_parent && runp->parent_handler)
08c3a6
+        runp->parent_handler ();
08c3a6
+
08c3a6
+      if (do_locking)
08c3a6
+        lll_lock (atfork_lock, LLL_PRIVATE);
08c3a6
+
08c3a6
+      /* We unlocked, ran the handler, and locked again.  In the meanwhile,
08c3a6
+         one or more [de]registrations could have occurred.  Due to this,
08c3a6
+         the list size must be updated.  */
08c3a6
+      sl = fork_handler_list_size (&fork_handlers);
08c3a6
+
08c3a6
+      /* The just-run handler could also have moved up the list. */
08c3a6
+
08c3a6
+      if (sl > i && fork_handler_list_at (&fork_handlers, i)->id == id)
08c3a6
+        /* The position of the recently run handler hasn't changed.  The
08c3a6
+           next handler to be run is an easy increment away.  */
08c3a6
+        i++;
08c3a6
+      else
08c3a6
+        {
08c3a6
+          /* The next handler to be run is the first handler in the list
08c3a6
+             to have an ID higher than the current one.  */
08c3a6
+          for (i = 0; i < sl; i++)
08c3a6
+            {
08c3a6
+              if (fork_handler_list_at (&fork_handlers, i)->id > id)
08c3a6
+                break;
08c3a6
+            }
08c3a6
+        }
08c3a6
     }
08c3a6
+
08c3a6
+  if (do_locking)
08c3a6
+    lll_unlock (atfork_lock, LLL_PRIVATE);
08c3a6
 }
08c3a6
 
08c3a6
 
08c3a6
diff --git a/sysdeps/pthread/Makefile b/sysdeps/pthread/Makefile
08c3a6
index 00419c4d199df912..5147588c130c9415 100644
08c3a6
--- a/sysdeps/pthread/Makefile
08c3a6
+++ b/sysdeps/pthread/Makefile
08c3a6
@@ -154,16 +154,36 @@ tests += tst-cancelx2 tst-cancelx3 tst-cancelx6 tst-cancelx8 tst-cancelx9 \
08c3a6
 	 tst-cleanupx0 tst-cleanupx1 tst-cleanupx2 tst-cleanupx3
08c3a6
 
08c3a6
 ifeq ($(build-shared),yes)
08c3a6
-tests += tst-atfork2 tst-pt-tls4 tst-_res1 tst-fini1 tst-create1
08c3a6
+tests += \
08c3a6
+  tst-atfork2 \
08c3a6
+  tst-pt-tls4 \
08c3a6
+  tst-_res1 \
08c3a6
+  tst-fini1 \
08c3a6
+  tst-create1 \
08c3a6
+  tst-atfork3 \
08c3a6
+  tst-atfork4 \
08c3a6
+# tests
08c3a6
+
08c3a6
 tests-nolibpthread += tst-fini1
08c3a6
 endif
08c3a6
 
08c3a6
-modules-names += tst-atfork2mod tst-tls4moda tst-tls4modb \
08c3a6
-		 tst-_res1mod1 tst-_res1mod2 tst-fini1mod \
08c3a6
-		 tst-create1mod
08c3a6
+modules-names += \
08c3a6
+  tst-atfork2mod \
08c3a6
+  tst-tls4moda \
08c3a6
+  tst-tls4modb \
08c3a6
+  tst-_res1mod1 \
08c3a6
+  tst-_res1mod2 \
08c3a6
+  tst-fini1mod \
08c3a6
+  tst-create1mod \
08c3a6
+  tst-atfork3mod \
08c3a6
+  tst-atfork4mod \
08c3a6
+# module-names
08c3a6
+
08c3a6
 test-modules = $(addprefix $(objpfx),$(addsuffix .so,$(modules-names)))
08c3a6
 
08c3a6
 tst-atfork2mod.so-no-z-defs = yes
08c3a6
+tst-atfork3mod.so-no-z-defs = yes
08c3a6
+tst-atfork4mod.so-no-z-defs = yes
08c3a6
 tst-create1mod.so-no-z-defs = yes
08c3a6
 
08c3a6
 ifeq ($(build-shared),yes)
08c3a6
@@ -226,8 +246,18 @@ tst-atfork2-ENV = MALLOC_TRACE=$(objpfx)tst-atfork2.mtrace \
08c3a6
 		  LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
08c3a6
 $(objpfx)tst-atfork2mod.so: $(shared-thread-library)
08c3a6
 
08c3a6
+$(objpfx)tst-atfork3: $(shared-thread-library)
08c3a6
+LDFLAGS-tst-atfork3 = -rdynamic
08c3a6
+$(objpfx)tst-atfork3mod.so: $(shared-thread-library)
08c3a6
+
08c3a6
+$(objpfx)tst-atfork4: $(shared-thread-library)
08c3a6
+LDFLAGS-tst-atfork4 = -rdynamic
08c3a6
+$(objpfx)tst-atfork4mod.so: $(shared-thread-library)
08c3a6
+
08c3a6
 ifeq ($(build-shared),yes)
08c3a6
 $(objpfx)tst-atfork2.out: $(objpfx)tst-atfork2mod.so
08c3a6
+$(objpfx)tst-atfork3.out: $(objpfx)tst-atfork3mod.so
08c3a6
+$(objpfx)tst-atfork4.out: $(objpfx)tst-atfork4mod.so
08c3a6
 endif
08c3a6
 
08c3a6
 ifeq ($(build-shared),yes)
08c3a6
diff --git a/sysdeps/pthread/tst-atfork3.c b/sysdeps/pthread/tst-atfork3.c
08c3a6
new file mode 100644
08c3a6
index 0000000000000000..bb2250e432ab79ad
08c3a6
--- /dev/null
08c3a6
+++ b/sysdeps/pthread/tst-atfork3.c
08c3a6
@@ -0,0 +1,118 @@
08c3a6
+/* Check if pthread_atfork handler can call dlclose (BZ#24595).
08c3a6
+   Copyright (C) 2022 Free Software Foundation, Inc.
08c3a6
+   This file is part of the GNU C Library.
08c3a6
+
08c3a6
+   The GNU C Library is free software; you can redistribute it and/or
08c3a6
+   modify it under the terms of the GNU Lesser General Public
08c3a6
+   License as published by the Free Software Foundation; either
08c3a6
+   version 2.1 of the License, or (at your option) any later version.
08c3a6
+
08c3a6
+   The GNU C Library is distributed in the hope that it will be useful,
08c3a6
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
08c3a6
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
08c3a6
+   Lesser General Public License for more details.
08c3a6
+
08c3a6
+   You should have received a copy of the GNU Lesser General Public
08c3a6
+   License along with the GNU C Library; if not, see
08c3a6
+   <http://www.gnu.org/licenses/>.  */
08c3a6
+
08c3a6
+#include <stdio.h>
08c3a6
+#include <pthread.h>
08c3a6
+#include <unistd.h>
08c3a6
+#include <stdlib.h>
08c3a6
+#include <stdbool.h>
08c3a6
+
08c3a6
+#include <support/check.h>
08c3a6
+#include <support/xthread.h>
08c3a6
+#include <support/capture_subprocess.h>
08c3a6
+#include <support/xdlfcn.h>
08c3a6
+
08c3a6
+/* Check if pthread_atfork handlers do not deadlock when calling a function
08c3a6
+   that might alter the internal fork handle list, such as dlclose.
08c3a6
+
08c3a6
+   The test registers a callback set with pthread_atfork(), dlopen() a shared
08c3a6
+   library (nptl/tst-atfork3mod.c), calls an exported symbol from the library
08c3a6
+   (which in turn also registers atfork handlers), and calls fork to trigger
08c3a6
+   the callbacks.  */
08c3a6
+
08c3a6
+static void *handler;
08c3a6
+static bool run_dlclose_prepare;
08c3a6
+static bool run_dlclose_parent;
08c3a6
+static bool run_dlclose_child;
08c3a6
+
08c3a6
+static void
08c3a6
+prepare (void)
08c3a6
+{
08c3a6
+  if (run_dlclose_prepare)
08c3a6
+    xdlclose (handler);
08c3a6
+}
08c3a6
+
08c3a6
+static void
08c3a6
+parent (void)
08c3a6
+{
08c3a6
+  if (run_dlclose_parent)
08c3a6
+    xdlclose (handler);
08c3a6
+}
08c3a6
+
08c3a6
+static void
08c3a6
+child (void)
08c3a6
+{
08c3a6
+  if (run_dlclose_child)
08c3a6
+    xdlclose (handler);
08c3a6
+}
08c3a6
+
08c3a6
+static void
08c3a6
+proc_func (void *closure)
08c3a6
+{
08c3a6
+}
08c3a6
+
08c3a6
+static void
08c3a6
+do_test_generic (bool dlclose_prepare, bool dlclose_parent, bool dlclose_child)
08c3a6
+{
08c3a6
+  run_dlclose_prepare = dlclose_prepare;
08c3a6
+  run_dlclose_parent = dlclose_parent;
08c3a6
+  run_dlclose_child = dlclose_child;
08c3a6
+
08c3a6
+  handler = xdlopen ("tst-atfork3mod.so", RTLD_NOW);
08c3a6
+
08c3a6
+  int (*atfork3mod_func)(void);
08c3a6
+  atfork3mod_func = xdlsym (handler, "atfork3mod_func");
08c3a6
+
08c3a6
+  atfork3mod_func ();
08c3a6
+
08c3a6
+  struct support_capture_subprocess proc
08c3a6
+    = support_capture_subprocess (proc_func, NULL);
08c3a6
+  support_capture_subprocess_check (&proc, "tst-atfork3", 0, sc_allow_none);
08c3a6
+
08c3a6
+  handler = atfork3mod_func = NULL;
08c3a6
+
08c3a6
+  support_capture_subprocess_free (&proc;;
08c3a6
+}
08c3a6
+
08c3a6
+static void *
08c3a6
+thread_func (void *closure)
08c3a6
+{
08c3a6
+  return NULL;
08c3a6
+}
08c3a6
+
08c3a6
+static int
08c3a6
+do_test (void)
08c3a6
+{
08c3a6
+  {
08c3a6
+    /* Make the process acts as multithread.  */
08c3a6
+    pthread_attr_t attr;
08c3a6
+    xpthread_attr_init (&attr);
08c3a6
+    xpthread_attr_setdetachstate (&attr, PTHREAD_CREATE_DETACHED);
08c3a6
+    xpthread_create (&attr, thread_func, NULL);
08c3a6
+  }
08c3a6
+
08c3a6
+  TEST_COMPARE (pthread_atfork (prepare, parent, child), 0);
08c3a6
+
08c3a6
+  do_test_generic (true  /* prepare */, false /* parent */, false /* child */);
08c3a6
+  do_test_generic (false /* prepare */, true  /* parent */, false /* child */);
08c3a6
+  do_test_generic (false /* prepare */, false /* parent */, true  /* child */);
08c3a6
+
08c3a6
+  return 0;
08c3a6
+}
08c3a6
+
08c3a6
+#include <support/test-driver.c>
08c3a6
diff --git a/sysdeps/pthread/tst-atfork3mod.c b/sysdeps/pthread/tst-atfork3mod.c
08c3a6
new file mode 100644
08c3a6
index 0000000000000000..6d0658cb9efdecbc
08c3a6
--- /dev/null
08c3a6
+++ b/sysdeps/pthread/tst-atfork3mod.c
08c3a6
@@ -0,0 +1,44 @@
08c3a6
+/* Copyright (C) 2022 Free Software Foundation, Inc.
08c3a6
+   This file is part of the GNU C Library.
08c3a6
+
08c3a6
+   The GNU C Library is free software; you can redistribute it and/or
08c3a6
+   modify it under the terms of the GNU Lesser General Public
08c3a6
+   License as published by the Free Software Foundation; either
08c3a6
+   version 2.1 of the License, or (at your option) any later version.
08c3a6
+
08c3a6
+   The GNU C Library is distributed in the hope that it will be useful,
08c3a6
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
08c3a6
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
08c3a6
+   Lesser General Public License for more details.
08c3a6
+
08c3a6
+   You should have received a copy of the GNU Lesser General Public
08c3a6
+   License along with the GNU C Library; if not, see
08c3a6
+   <http://www.gnu.org/licenses/>.  */
08c3a6
+
08c3a6
+#include <unistd.h>
08c3a6
+#include <stdlib.h>
08c3a6
+#include <pthread.h>
08c3a6
+
08c3a6
+#include <support/check.h>
08c3a6
+
08c3a6
+static void
08c3a6
+mod_prepare (void)
08c3a6
+{
08c3a6
+}
08c3a6
+
08c3a6
+static void
08c3a6
+mod_parent (void)
08c3a6
+{
08c3a6
+}
08c3a6
+
08c3a6
+static void
08c3a6
+mod_child (void)
08c3a6
+{
08c3a6
+}
08c3a6
+
08c3a6
+int atfork3mod_func (void)
08c3a6
+{
08c3a6
+  TEST_COMPARE (pthread_atfork (mod_prepare, mod_parent, mod_child), 0);
08c3a6
+
08c3a6
+  return 0;
08c3a6
+}
08c3a6
diff --git a/sysdeps/pthread/tst-atfork4.c b/sysdeps/pthread/tst-atfork4.c
08c3a6
new file mode 100644
08c3a6
index 0000000000000000..52dc87e73b846ab9
08c3a6
--- /dev/null
08c3a6
+++ b/sysdeps/pthread/tst-atfork4.c
08c3a6
@@ -0,0 +1,128 @@
08c3a6
+/* pthread_atfork supports handlers that call pthread_atfork or dlclose.
08c3a6
+   Copyright (C) 2022 Free Software Foundation, Inc.
08c3a6
+   This file is part of the GNU C Library.
08c3a6
+
08c3a6
+   The GNU C Library is free software; you can redistribute it and/or
08c3a6
+   modify it under the terms of the GNU Lesser General Public
08c3a6
+   License as published by the Free Software Foundation; either
08c3a6
+   version 2.1 of the License, or (at your option) any later version.
08c3a6
+
08c3a6
+   The GNU C Library is distributed in the hope that it will be useful,
08c3a6
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
08c3a6
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
08c3a6
+   Lesser General Public License for more details.
08c3a6
+
08c3a6
+   You should have received a copy of the GNU Lesser General Public
08c3a6
+   License along with the GNU C Library; if not, see
08c3a6
+   <https://www.gnu.org/licenses/>.  */
08c3a6
+
08c3a6
+#include <support/xdlfcn.h>
08c3a6
+#include <stdio.h>
08c3a6
+#include <support/xthread.h>
08c3a6
+#include <sys/types.h>
08c3a6
+#include <sys/wait.h>
08c3a6
+#include <support/xunistd.h>
08c3a6
+#include <support/check.h>
08c3a6
+#include <stdlib.h>
08c3a6
+
08c3a6
+static void *
08c3a6
+thread_func (void *x)
08c3a6
+{
08c3a6
+  return NULL;
08c3a6
+}
08c3a6
+
08c3a6
+static unsigned int second_atfork_handler_runcount = 0;
08c3a6
+
08c3a6
+static void
08c3a6
+second_atfork_handler (void)
08c3a6
+{
08c3a6
+  second_atfork_handler_runcount++;
08c3a6
+}
08c3a6
+
08c3a6
+static void *h = NULL;
08c3a6
+
08c3a6
+static unsigned int atfork_handler_runcount = 0;
08c3a6
+
08c3a6
+static void
08c3a6
+prepare (void)
08c3a6
+{
08c3a6
+  /* These atfork handlers are registered while atfork handlers are being
08c3a6
+     executed and thus will not be executed during the corresponding
08c3a6
+     fork.  */
08c3a6
+  TEST_VERIFY_EXIT (pthread_atfork (second_atfork_handler,
08c3a6
+                                    second_atfork_handler,
08c3a6
+                                    second_atfork_handler) == 0);
08c3a6
+
08c3a6
+  /* This will de-register the atfork handlers registered by the dlopen'd
08c3a6
+     library and so they will not be executed.  */
08c3a6
+  if (h != NULL)
08c3a6
+    {
08c3a6
+      xdlclose (h);
08c3a6
+      h = NULL;
08c3a6
+    }
08c3a6
+
08c3a6
+  atfork_handler_runcount++;
08c3a6
+}
08c3a6
+
08c3a6
+static void
08c3a6
+after (void)
08c3a6
+{
08c3a6
+  atfork_handler_runcount++;
08c3a6
+}
08c3a6
+
08c3a6
+static int
08c3a6
+do_test (void)
08c3a6
+{
08c3a6
+  /* Make sure __libc_single_threaded is 0.  */
08c3a6
+  pthread_attr_t attr;
08c3a6
+  xpthread_attr_init (&attr);
08c3a6
+  xpthread_attr_setdetachstate (&attr, PTHREAD_CREATE_DETACHED);
08c3a6
+  xpthread_create (&attr, thread_func, NULL);
08c3a6
+
08c3a6
+  void (*reg_atfork_handlers) (void);
08c3a6
+
08c3a6
+  h = xdlopen ("tst-atfork4mod.so", RTLD_LAZY);
08c3a6
+
08c3a6
+  reg_atfork_handlers = xdlsym (h, "reg_atfork_handlers");
08c3a6
+
08c3a6
+  reg_atfork_handlers ();
08c3a6
+
08c3a6
+  /* We register our atfork handlers *after* loading the module so that our
08c3a6
+     prepare handler is called first at fork, where we then dlclose the
08c3a6
+     module before its prepare handler has a chance to be called.  */
08c3a6
+  TEST_VERIFY_EXIT (pthread_atfork (prepare, after, after) == 0);
08c3a6
+
08c3a6
+  pid_t pid = xfork ();
08c3a6
+
08c3a6
+  /* Both the parent and the child processes should observe this.  */
08c3a6
+  TEST_VERIFY_EXIT (atfork_handler_runcount == 2);
08c3a6
+  TEST_VERIFY_EXIT (second_atfork_handler_runcount == 0);
08c3a6
+
08c3a6
+  if (pid > 0)
08c3a6
+    {
08c3a6
+      int childstat;
08c3a6
+
08c3a6
+      xwaitpid (-1, &childstat, 0);
08c3a6
+      TEST_VERIFY_EXIT (WIFEXITED (childstat)
08c3a6
+                        && WEXITSTATUS (childstat) == 0);
08c3a6
+
08c3a6
+      /* This time, the second set of atfork handlers should also be called
08c3a6
+         since the handlers are already in place before fork is called.  */
08c3a6
+
08c3a6
+      pid = xfork ();
08c3a6
+
08c3a6
+      TEST_VERIFY_EXIT (atfork_handler_runcount == 4);
08c3a6
+      TEST_VERIFY_EXIT (second_atfork_handler_runcount == 2);
08c3a6
+
08c3a6
+      if (pid > 0)
08c3a6
+        {
08c3a6
+          xwaitpid (-1, &childstat, 0);
08c3a6
+          TEST_VERIFY_EXIT (WIFEXITED (childstat)
08c3a6
+                            && WEXITSTATUS (childstat) == 0);
08c3a6
+        }
08c3a6
+    }
08c3a6
+
08c3a6
+  return 0;
08c3a6
+}
08c3a6
+
08c3a6
+#include <support/test-driver.c>
08c3a6
diff --git a/sysdeps/pthread/tst-atfork4mod.c b/sysdeps/pthread/tst-atfork4mod.c
08c3a6
new file mode 100644
08c3a6
index 0000000000000000..e111efeb185916e0
08c3a6
--- /dev/null
08c3a6
+++ b/sysdeps/pthread/tst-atfork4mod.c
08c3a6
@@ -0,0 +1,48 @@
08c3a6
+/* pthread_atfork supports handlers that call pthread_atfork or dlclose.
08c3a6
+   Copyright (C) 2022 Free Software Foundation, Inc.
08c3a6
+   This file is part of the GNU C Library.
08c3a6
+
08c3a6
+   The GNU C Library is free software; you can redistribute it and/or
08c3a6
+   modify it under the terms of the GNU Lesser General Public
08c3a6
+   License as published by the Free Software Foundation; either
08c3a6
+   version 2.1 of the License, or (at your option) any later version.
08c3a6
+
08c3a6
+   The GNU C Library is distributed in the hope that it will be useful,
08c3a6
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
08c3a6
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
08c3a6
+   Lesser General Public License for more details.
08c3a6
+
08c3a6
+   You should have received a copy of the GNU Lesser General Public
08c3a6
+   License along with the GNU C Library; if not, see
08c3a6
+   <https://www.gnu.org/licenses/>.  */
08c3a6
+
08c3a6
+#include <pthread.h>
08c3a6
+#include <stdlib.h>
08c3a6
+
08c3a6
+/* This dynamically loaded library simply registers its atfork handlers when
08c3a6
+   asked to.  The atfork handlers should never be executed because the
08c3a6
+   library is unloaded before fork is called by the test program.  */
08c3a6
+
08c3a6
+static void
08c3a6
+prepare (void)
08c3a6
+{
08c3a6
+  abort ();
08c3a6
+}
08c3a6
+
08c3a6
+static void
08c3a6
+parent (void)
08c3a6
+{
08c3a6
+  abort ();
08c3a6
+}
08c3a6
+
08c3a6
+static void
08c3a6
+child (void)
08c3a6
+{
08c3a6
+  abort ();
08c3a6
+}
08c3a6
+
08c3a6
+void
08c3a6
+reg_atfork_handlers (void)
08c3a6
+{
08c3a6
+  pthread_atfork (prepare, parent, child);
08c3a6
+}