Re: [musl] doubt about fork

[Rich Felker <dalias@libc.org>]

On Fri, Apr 03, 2020 at 11:28:54AM +0200, Szabolcs Nagy wrote:
> * guolongqiang <guolongqiang@huawei.com> [2020-04-03 06:37:44 +0000]:
> > Hello,
> > I have a problem about multi threads fork. The implement of fork not lock such as stdio file,
> > __thread_list_lock, or other global mutexs in musl libc before syscall of SYS_clone, this will
> > cause dead lock in child. Is this a bug?
> 
> the standard is pretty clear that the child after fork
> in a multi-threaded process can only do async-signal-safe
> operations, anything that may lock is not as-safe.
> 
> https://pubs.opengroup.org/onlinepubs/9699919799/functions/fork.html

Note that future editions of POSIX might change this by removing the
requirement that fork be AS-safe and adding _fork (I may be
misremembering the name but it's something like that) to be AS-safe.
So it's possible this could change in the future. But for now, indeed,
what you can do in the child if a multithreaded process forks is
extremely limited.

As an aside, musl will continue to track the standards, but personally
I'm against any such "improvements" to fork because I'm against fork
itself. Use of fork without immediate exec (that could be replaced by
posix_spawn or vfork) makes software incompatible with a MMU-less
environment and significantly harms security/hardening properties --
all potentially secret data from the parent that hasn't been scrubbed
leaks into the child where it might be disclosed later, and the child
lacks independent ASLR from the parent (see the classic Android Zygote
issue that completely undermined ASLR). It also significantly harms
memory usage accounting and performance by requiring that all of the
parent's memory usage continue to be charged against the child too
even if the child will not use most of it, and by converting all
writable pages in both the parent and child to copy-on-write (making
next access fault). Modern designs should serialize whatever data the
child is actually intending to use and spawn/exec a child that
deserializes it.

Rich