Hi,

I'm experiencing segmentation fault when I invoke aio_cancel on request
which is in EINPROGRESS state. This happens only with libc muls (used
version - 1.1.12-r8) and only on one (dual Intel Xeon Gold 6128) of few
computers I've tried it on - please let me know if you need more
information about that machine. Attached is very simple program
(aioWrite.cpp) that reproduces this problem.

alpine-tmp-0:~$ ./aioWrite
Segmentation fault (core dumped)

Bt from gdb shows problem is in aio_cancel.

(gdb) r
Starting program: ~/aioWrite
[New LWP 70321]

Program received signal ?, Unknown signal.
[Switching to LWP 70321]
__cp_end () at src/thread/x86_64/syscall_cp.s:29
29    src/thread/x86_64/syscall_cp.s: No such file or directory.
(gdb) bt
#0  __cp_end () at src/thread/x86_64/syscall_cp.s:29
#1  0x00007ffff7dc6919 in __syscall_cp_c (nr=18, u=<optimized out>,
v=<optimized out>, w=<optimized out>, x=<optimized out>, y=<optimized out>,
z=0) at src/thread/pthread_cancel.c:37
#2  0x00007ffff7dcc0df in pwrite (fd=fd@entry=3, buf=buf@entry=0x7ffffff81900,
size=size@entry=512512, ofs=ofs@entry=0) at src/unistd/pwrite.c:7
#3  0x00007ffff7d8974e in io_thread_func (ctx=<optimized out>) at
src/aio/aio.c:240
#4  0x00007ffff7dc7293 in start (p=0x7ffff7ff4ab0) at
src/thread/pthread_create.c:145
#5  0x00007ffff7dc6072 in __clone () at src/thread/x86_64/clone.s:21
Backtrace stopped: frame did not save the PC
(gdb) info threads
  Id   Target Id         Frame
* 2    LWP 70321 "aioWrite" __cp_end () at src/thread/x86_64/syscall_cp.s:29
  1    LWP 70317 "aioWrite" __wait (addr=addr@entry=0x7ffff7ff49f8,
waiters=waiters@entry=0x0, val=val@entry=-1, priv=<optimized out>,
priv@entry=1) at src/thread/__wait.c:14
(gdb) thread 1
[Switching to thread 1 (LWP 70317)]
#0  __wait (addr=addr@entry=0x7ffff7ff49f8, waiters=waiters@entry=0x0,
val=val@entry=-1, priv=<optimized out>, priv@entry=1) at
src/thread/__wait.c:14
14    src/thread/__wait.c: No such file or directory.
(gdb) bt
#0  __wait (addr=addr@entry=0x7ffff7ff49f8, waiters=waiters@entry=0x0,
val=val@entry=-1, priv=<optimized out>, priv@entry=1) at
src/thread/__wait.c:14
#1  0x00007ffff7d89b30 in aio_cancel (fd=<optimized out>,
cb=0x7ffffff04640) at src/aio/aio.c:356
#2  0x0000000000400c54 in main () at aioWrite.cpp:45
(gdb)

In other application (which code I cannot share) I was able to get more
detailed trace for main thread, narrowing problem to pthread_kill call.

Program received signal ?, Unknown signal.
[Switching to LWP 70293]
__cp_end () at src/thread/x86_64/syscall_cp.s:29
29    src/thread/x86_64/syscall_cp.s: No such file or directory.
(gdb) thread 1
[Switching to thread 1 (LWP 60762)]
#0  0x00007ffff7dc7ac4 in pthread_kill (t=t@entry=0x7ffff7fdeab0,
sig=sig@entry=33) at src/thread/pthread_kill.c:7
7    src/thread/pthread_kill.c: No such file or directory.
(gdb) bt
#0  0x00007ffff7dc7ac4 in pthread_kill (t=t@entry=0x7ffff7fdeab0,
sig=sig@entry=33) at src/thread/pthread_kill.c:7
#1  0x00007ffff7dc69eb in pthread_cancel (t=0x7ffff7fdeab0) at
src/thread/pthread_cancel.c:99
#2  0x00007ffff7d89b1d in aio_cancel (fd=<optimized out>, cb=0xf4e180) at
src/aio/aio.c:355

Operating system is containerized alpine linux:
Linux alpine-tmp-0 4.15.0-20-generic #21-Ubuntu SMP Tue Apr 24 06:16:15 UTC
2018 x86_64 Linux

Best Regards,