Re: [PATCH 1/2] treewide: use _exit() over exit()

[Stefano Brivio <sbrivio@redhat.com>]

On Wed,  5 Feb 2025 14:00:41 +0100
Paul Holzinger <pholzing@redhat.com> wrote:

> In the podman CI I noticed many seccomp denials in our logs even though
> tests passed:
> comm="pasta.avx2" exe="/usr/bin/pasta.avx2" sig=31 arch=c000003e
> syscall=202 compat=0 ip=0x7fb3d31f69db code=0x80000000
> 
> Which is futex being called and blocked by the pasta profile. After a
> few tries I managed to reproduce locally with this loop in ~20 min:
> while :;
>   do podman run -d --network bridge quay.io/libpod/testimage:20241011 \
> 	sleep 100 && \
>   sleep 10 && \
>   podman rm -fa -t0
> done
> 
> And using a pasta version with prctl(PR_SET_DUMPABLE, 1); set I got the
> following stack trace:
> Stack trace of thread 1:
>   #0  0x00007fc95e6de91b __lll_lock_wait_private (libc.so.6 + 0x9491b)
>   #1  0x00007fc95e68d6de __run_exit_handlers (libc.so.6 + 0x436de)
>   #2  0x00007fc95e68d70e exit (libc.so.6 + 0x4370e)
>   #3  0x000055f31b78c50b n/a (n/a + 0x0)
>   #4  0x00007fc95e68d70e exit (libc.so.6 + 0x4370e)
>   #5  0x000055f31b78d5a2 n/a (n/a + 0x0)
> 
> Pasta got killed in exit(), it seems glibc is trying to use a lock when
> running exit handlers even though no exit handlers are defined.
> 
> Given no exit handlers are needed we can call _exit() instead. This
> skips exit handlers and does not flush stdio streams compared to exit()
> which should be fine for the use here.
> 
> Based on the input from Stefano I did not change the test/doc programs
> or qrap as they do not use seccomp filters.
> 
> Signed-off-by: Paul Holzinger <pholzing@redhat.com>

Applied.

-- 
Stefano